openapi: 3.0.0
info:
  title: Snyk API
  contact: {}
  version: '1.0'
  description: Snyk V1 API
servers:
  - url: https://api.snyk.io/v1
    variables: {}
paths:
  /user/{userId}:
    get:
      tags:
        - Users
      summary: Get User Details
      description: Retrieves information about a user.
      operationId: GetUserDetails
      parameters:
        - name: userId
          in: path
          description: The users ID. The `API_KEY` must have admin access to at least one group or organization where the requested user is a member and must have the `api` entitlement on their preferred organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/GetUserDetailsresponse'
                  - example:
                      id: ''
                      name: ''
                      username: ''
                      email: ''
        '400':
          description: The provided `id` is not in a valid format.
          headers: {}
          content:
            application/json:
              schema:
                type: object
                description: The provided `id` is not in a valid format.
                example: {}
              example: {}
        '401':
          description: '`API_KEY` is invalid.'
          headers: {}
          content:
            application/json:
              schema:
                type: object
                description: '`API_KEY` is invalid.'
                example: {}
              example: {}
        '404':
          description: The requested user could not be found or caller does not have sufficient permissions.
          headers: {}
          content:
            application/json:
              schema:
                type: object
                description: The requested user could not be found or caller does not have sufficient permissions.
                example: {}
              example: {}
      deprecated: false
  /user/me:
    get:
      tags:
        - Users
      summary: Get My Details
      description: Retrieves information about the the user making the request.
      operationId: GetMyDetails
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/GetMyDetailsresponse'
                  - example:
                      id: ''
                      username: ''
                      email: ''
                      orgs: []
        '401':
          description: '`API_KEY` is invalid.'
          headers: {}
          content:
            application/json:
              schema:
                type: object
                description: '`API_KEY` is invalid.'
                example: {}
              example: {}
      deprecated: false
  /user/me/notification-settings/org/{orgId}:
    get:
      tags:
        - Users
      summary: Get organization notification settings
      description: The organization notification settings for the user that will determine which emails are sent.
      operationId: Getorganizationnotificationsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Notificationsettingsresponse'
                  - example:
                      new-issues-remediations:
                        enabled: true
                        issueSeverity: high
                        issueType: vuln
                        inherited: false
                      project-imported:
                        enabled: true
                        inherited: false
                      test-limit:
                        enabled: true
                        inherited: false
                      weekly-report:
                        enabled: true
                        inherited: false
                      request-updates:
                        enabled: true
                        inherited: false
                      pending-requests:
                        enabled: true
                        inherited: false
              example:
                new-issues-remediations:
                  enabled: true
                  issueSeverity: high
                  issueType: vuln
                  inherited: false
                project-imported:
                  enabled: true
                  inherited: false
                test-limit:
                  enabled: true
                  inherited: false
                weekly-report:
                  enabled: true
                  inherited: false
                request-updates:
                  enabled: true
                  inherited: false
                pending-requests:
                  enabled: true
                  inherited: false
      deprecated: false
    put:
      tags:
        - Users
      summary: Modify organization notification settings
      description: The organization notification settings for the user that will determine which emails are sent.
      operationId: Modifyorganizationnotificationsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Notificationsettingsrequest'
                - example:
                    new-issues-remediations:
                      enabled: true
                      issueSeverity: high
                      issueType: vuln
                    project-imported:
                      enabled: true
                    test-limit:
                      enabled: true
                    weekly-report:
                      enabled: true
                    request-updates:
                      enabled: true
                    pending-requests:
                      enabled: true
            example:
              new-issues-remediations:
                enabled: true
                issueSeverity: high
                issueType: vuln
              project-imported:
                enabled: true
              test-limit:
                enabled: true
              weekly-report:
                enabled: true
              request-updates:
                enabled: true
              pending-requests:
                enabled: true
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Notificationsettingsresponse'
                  - example:
                      new-issues-remediations:
                        enabled: true
                        issueSeverity: high
                        issueType: vuln
                        inherited: false
                      project-imported:
                        enabled: true
                        inherited: false
                      test-limit:
                        enabled: true
                        inherited: false
                      weekly-report:
                        enabled: true
                        inherited: false
                      request-updates:
                        enabled: true
                        inherited: false
                      pending-requests:
                        enabled: true
                        inherited: false
              example:
                new-issues-remediations:
                  enabled: true
                  issueSeverity: high
                  issueType: vuln
                  inherited: false
                project-imported:
                  enabled: true
                  inherited: false
                test-limit:
                  enabled: true
                  inherited: false
                weekly-report:
                  enabled: true
                  inherited: false
      deprecated: false
  /user/me/notification-settings/org/{orgId}/project/{projectId}:
    get:
      tags:
        - Users
      summary: Get project notification settings
      description: The project notification settings for the user that will determine which emails are sent.
      operationId: Getprojectnotificationsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to return notification settings for.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Notificationsettingsresponse'
                  - example:
                      new-issues-remediations:
                        enabled: true
                        issueSeverity: high
                        issueType: vuln
                        inherited: false
                      project-imported:
                        enabled: true
                        inherited: false
                      test-limit:
                        enabled: true
                        inherited: false
                      weekly-report:
                        enabled: true
                        inherited: false
              example:
                new-issues-remediations:
                  enabled: true
                  issueSeverity: high
                  issueType: vuln
                  inherited: false
                project-imported:
                  enabled: true
                  inherited: false
                test-limit:
                  enabled: true
                  inherited: false
                weekly-report:
                  enabled: true
                  inherited: false
      deprecated: false
    put:
      tags:
        - Users
      summary: Modify project notification settings
      description: The project notification settings for the user that will determine which emails are sent.
      operationId: Modifyprojectnotificationsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to return notification settings for.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Modifyprojectnotificationsettingsrequest'
                - example:
                    new-issues-remediations:
                      enabled: true
                      issueSeverity: high
                      issueType: vuln
            example:
              new-issues-remediations:
                enabled: true
                issueSeverity: high
                issueType: vuln
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /group/{groupId}/settings:
    get:
      tags:
        - Groups
      summary: View group settings
      description: ''
      operationId: Viewgroupsettings
      parameters:
        - name: groupId
          in: path
          description: The group ID. The `API_KEY` must have admin access to this group.
          required: true
          style: simple
          schema:
            type: string
            example: b61bc07c-27c6-42b3-8b04-0f228ed31a67
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Groupsettings'
      deprecated: false
    put:
      tags:
        - Groups
      summary: Update group settings
      description: ''
      operationId: Updategroupsettings
      parameters:
        - name: groupId
          in: path
          description: The group ID. The `API_KEY` must have admin access to this group.
          required: true
          style: simple
          schema:
            type: string
            example: b61bc07c-27c6-42b3-8b04-0f228ed31a67
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Groupsettings'
                - example:
                    sessionLength: 50
                    requestAccess:
                      enabled: true
            example:
              sessionLength: 50
              requestAccess:
                enabled: true
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Groupsettings'
                  - example:
                      sessionLength: 50
                      requestAccess:
                        enabled: true
              example:
                sessionLength: 50
                requestAccess:
                  enabled: true
      deprecated: false
  /group/{groupId}/members:
    get:
      tags:
        - Groups
      summary: List all members in a group
      description: '> **Note**: Requests to this endpoint are limited to one per minute. Additional requests within this time will receive a `429 Too Many Requests` response.'
      operationId: Listallmembersinagroup
      parameters:
        - name: groupId
          in: path
          description: The group ID. The `API_KEY` must have access admin to this group.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Listallmembersinagroupresponse'
                description: ''
                example:
                  - id: ''
                    name: ''
                    username: ''
                    email: ''
                    orgs:
                      - name: ''
                        role: ''
                    groupRole: ''
              example:
                - id: ''
                  name: ''
                  username: ''
                  email: ''
                  orgs:
                    - name: ''
                      role: ''
                  groupRole: ''
      deprecated: false
  /group/{groupId}/org/{orgId}/members:
    post:
      tags:
        - Groups
      summary: Add a member to an organization within a group
      description: ''
      operationId: Addamembertoanorganizationwithinagroup
      parameters:
        - name: groupId
          in: path
          description: The group ID. The `API_KEY` must have access admin to this group.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: orgId
          in: path
          description: The organization ID we want to add the member to. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Addmemberbody'
                - example:
                    userId: ''
                    role: ''
            example:
              userId: ''
              role: ''
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /group/{groupId}/tags:
    get:
      tags:
        - Groups
      summary: List all tags in a group
      description: ''
      operationId: Listalltagsinagroup
      parameters:
        - name: groupId
          in: path
          description: The group ID. The `API_KEY` must have access admin to this group.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: perPage
          in: query
          description: The number of results to return (the default is 1000).
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 10
        - name: page
          in: query
          description: The offset from which to start returning results from.
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 1
        
      responses:
        '200':
          description: ''
          headers:
            Link:
              content:
                text/plain:
                  schema:
                    type: string
                  example: <https://api.snyk.io/v1/group/4a18d42f-0706-4ad0-b127-24078731fbed/tags?page=3&perPage=10>; rel=last, <https://api.snyk.io/v1/group/4a18d42f-0706-4ad0-b127-24078731fbed/tags?page=2&perPage=10>; rel=next
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Listalltagsinagroupresponse'
                  - example:
                      tags:
                        - key: meta
                          value: Alfa
                        - key: meta
                          value: Bravo
                        - key: meta
                          value: Charlie
                        - key: meta
                          value: Delta
                        - key: meta
                          value: Echo
                        - key: meta
                          value: Foxtrot
                        - key: meta
                          value: Golf
                        - key: meta
                          value: Hotel
                        - key: meta
                          value: India
                        - key: meta
                          value: Juliet
              example:
                tags:
                  - key: meta
                    value: Alfa
                  - key: meta
                    value: Bravo
                  - key: meta
                    value: Charlie
                  - key: meta
                    value: Delta
                  - key: meta
                    value: Echo
                  - key: meta
                    value: Foxtrot
                  - key: meta
                    value: Golf
                  - key: meta
                    value: Hotel
                  - key: meta
                    value: India
                  - key: meta
                    value: Juliet
      deprecated: false
  /group/{groupId}/tags/delete:
    post:
      tags:
        - Groups
      summary: Delete tag from group
      description: ''
      operationId: Deletetagfromgroup
      parameters:
        - name: groupId
          in: path
          description: The group ID. The `API_KEY` must have access admin to this group.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Deletetagbody'
                - example:
                    key: ''
                    value: ''
                    force: false
            example:
              key: ''
              value: ''
              force: false
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Deletetagbody'
                  - example:
                      key: ''
                      value: ''
                      force: false
              example:
                key: ''
                value: ''
                force: false
      deprecated: false
  /group/{groupId}/orgs:
    get:
      tags:
        - Groups
      summary: List all organizations in a group
      description: ''
      operationId: Listallorganizationsinagroup
      parameters:
        - name: groupId
          in: path
          description: The group ID. The `API_KEY` must have READ access to this group and LIST organizations access in this group.
          required: true
          style: simple
          schema:
            type: string
            example: a060a49f-636e-480f-9e14-38e773b2a97f
        - name: perPage
          in: query
          description: The number of results to return (maximum is 100).
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 100
        - name: page
          in: query
          description: For pagination - offset (from which to start returning results).
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 1
        - name: name
          in: query
          description: Only organizations that have a name that **starts with** this value (case insensitive) will be returned.
          style: form
          explode: true
          schema:
            type: string
            example: my
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Listallorganizationsinagroupresponse'
                  - example:
                      id: a060a49f-636e-480f-9e14-38e773b2a97f
                      name: ACME Inc.
                      url: https://api.snyk.io/v1/group/0dfc509a-e7a9-48ef-9d39-649d6468fc09
                      created: 2021-06-07T00:00:00.000Z
                      orgs:
                        - name: myDefaultOrg
                          id: 689ce7f9-7943-4a71-b704-2ba575f01089
                          slug: my-default-org
                          url: https://api.snyk.io/v1/org/default-org
                          created: 2021-06-07T00:00:00.000Z
                        - name: My Other Org
                          id: a04d9cbd-ae6e-44af-b573-0556b0ad4bd2
                          slug: my-other-org
                          url: https://api.snyk.io/v1/org/my-other-org
                          created: 2021-06-07T00:00:00.000Z
      deprecated: false
  /group/{groupId}/roles:
    get:
      tags:
        - Groups
      summary: List all roles in a group
      description: ''
      operationId: Listallrolesinagroup
      parameters:
        - name: groupId
          in: path
          description: The group ID. The `API_KEY` must have READ access to this group.
          required: true
          style: simple
          schema:
            type: string
            example: a060a49f-636e-480f-9e14-38e773b2a97f
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Listallrolesinagroupresponse'
                description: ''
                example:
                  - name: Org Collaborator
                    description: Collaborator
                    publicId: 6525b356-a400-465f-b2e5-3eee1161e69f
                    created: 2021-04-22T16:02:53.233Z
                    modified: 2021-04-22T16:02:53.332Z
                  - name: Org Admin
                    description: Admin
                    publicId: af047fef-69f3-4bd9-9760-8957ce0d2ece
                    created: 2021-04-22T16:02:53.233Z
                    modified: 2021-04-22T16:02:53.332Z
              example:
                - name: Org Collaborator
                  description: Collaborator
                  publicId: 6525b356-a400-465f-b2e5-3eee1161e69f
                  created: 2021-04-22T16:02:53.233Z
                  modified: 2021-04-22T16:02:53.332Z
                - name: Org Admin
                  description: Admin
                  publicId: af047fef-69f3-4bd9-9760-8957ce0d2ece
                  created: 2021-04-22T16:02:53.233Z
                  modified: 2021-04-22T16:02:53.332Z
      deprecated: false
  /orgs:
    get:
      tags:
        - Organizations
      summary: List all the organizations a user belongs to
      description: >-
        Each request to Snyk has to be done in the context of a Snyk organization. If no organization is specified, the user's default organization (user is identified according to the `API_KEY`) will be used.

        The organization determines the access rights, licenses policy and is the unit of billing for private projects.

        An organization should be given as a query parameter named `org`, with the public identifier given to this org. The list of organizations and their corresponding public ids can be found with the organization resource

        #### Required permissions

        - `View Organization`
      operationId: Listalltheorganizationsauserbelongsto        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Listalltheorganizationsauserbelongstoresponse'
      deprecated: false
  /org:
    post:
      tags:
        - Organizations
      summary: Create a new organization
      description: An organization can be created as part of a group, or independently. If the **groupId** is not provided, a **Personal Org** will be created independent of a group.
      operationId: Createaneworganization
      parameters: []
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Createorganizationsbody'
                - example:
                    name: new-org
                    groupId: 4a18d42f-0706-4ad0-b127-24078731fbed
                    sourceOrgId: 6b4a3261-b68f-43a0-9218-1f082e77f879
            example:
              name: new-org
              groupId: 4a18d42f-0706-4ad0-b127-24078731fbed
              sourceOrgId: 6b4a3261-b68f-43a0-9218-1f082e77f879
        required: true
      responses:
        '201':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Createaneworganizationresponse'
                  - example:
                      id: 0356f641-c55c-488f-af05-c2122590f369
                      name: new-org
                      slug: new-org
                      url: https://api.snyk.io/v1/org/new-org
                      created: 2021-01-07T16:07:16.237Z
                      group:
                        name: test-group
                        id: 4a18d42f-0706-4ad0-b127-24078731fbed
        '401':
          description: Authorization errors.
          headers: {}
          content:
            application/json, charset=utf-8:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Createaneworganizationresponse1'
                  - description: Authorization errors.
                    example:
                      message: You must have the required permissions to add an org
                      errorRef: 49f168a0-a084-4cd8-93ff-63f3a0f06bc6
              example:
                message: You must have the required permissions to add an org
                errorRef: 49f168a0-a084-4cd8-93ff-63f3a0f06bc6
        '400':
          description: A group of errors that happened in the process of creating a new organization and were unexpected
          headers: {}
          content:
            application/json, charset=utf-8:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Createaneworganizationresponse1'
                  - description: A group of errors that happened in the process of creating a new organization and were unexpected
                    example:
                      message: Unexpected error whilst deleting org
                      errorRef: 49f168a0-a084-4cd8-93ff-63f3a0f06bc6
              example:
                message: Unexpected error whilst deleting org
                errorRef: 49f168a0-a084-4cd8-93ff-63f3a0f06bc6
        '422':
          description: A group of errors that show input errors about the parameters provided in the request.
          headers: {}
          content:
            application/json, charset=utf-8:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Createaneworganizationresponse1'
                  - description: A group of errors that show input errors about the parameters provided in the request.
                    example:
                      message: Please provide a new organization name in the body of the request
                      errorRef: 49f168a0-a084-4cd8-93ff-63f3a0f06bc6
              example:
                message: Please provide a new organization name in the body of the request
                errorRef: 49f168a0-a084-4cd8-93ff-63f3a0f06bc6
      deprecated: false
  /org/{orgId}/notification-settings:
    get:
      tags:
        - Organizations
      summary: Get organization notification settings
      description: >-
        Manage the default settings for organization notifications. These will be used as defaults, but can be re-defined by organization members

        #### Required permissions


        - `View Organization`
      operationId: Getorganizationnotificationsettings1
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Notificationsettingsresponse'
                  - example:
                      new-issues-remediations:
                        enabled: true
                        issueSeverity: high
                        issueType: vuln
                        inherited: false
                      project-imported:
                        enabled: true
                        inherited: false
                      test-limit:
                        enabled: true
                        inherited: false
                      weekly-report:
                        enabled: true
                        inherited: false
                      request-updates:
                        enabled: true
                        inherited: false
                      pending-requests:
                        enabled: true
                        inherited: false
              example:
                new-issues-remediations:
                  enabled: true
                  issueSeverity: high
                  issueType: vuln
                  inherited: false
                project-imported:
                  enabled: true
                  inherited: false
                test-limit:
                  enabled: true
                  inherited: false
                weekly-report:
                  enabled: true
                  inherited: false
                request-updates:
                  enabled: true
                  inherited: false
                pending-requests:
                  enabled: true
                  inherited: false
      deprecated: false
    put:
      tags:
        - Organizations
      summary: Set notification settings
      description: >-
        Manage the default settings for organization notifications. These will be used as defaults, but can be re-defined by organization members

        #### Required permissions


        - `View Organization`


        - `Edit Organization`
      operationId: Setnotificationsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Notificationsettingsrequest'
                - example:
                    new-issues-remediations:
                      enabled: true
                      issueSeverity: high
                      issueType: vuln
                    project-imported:
                      enabled: true
                    test-limit:
                      enabled: true
                    weekly-report:
                      enabled: true
                    request-updates:
                      enabled: true
                    pending-requests:
                      enabled: true
            example:
              new-issues-remediations:
                enabled: true
                issueSeverity: high
                issueType: vuln
              project-imported:
                enabled: true
              test-limit:
                enabled: true
              weekly-report:
                enabled: true
              request-updates:
                enabled: true
              pending-requests:
                enabled: true
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Notificationsettingsresponse'
                  - example:
                      new-issues-remediations:
                        enabled: true
                        issueSeverity: high
                        issueType: vuln
                        inherited: false
                      project-imported:
                        enabled: true
                        inherited: false
                      test-limit:
                        enabled: true
                        inherited: false
                      weekly-report:
                        enabled: true
                        inherited: false
              example:
                new-issues-remediations:
                  enabled: true
                  issueSeverity: high
                  issueType: vuln
                  inherited: false
                project-imported:
                  enabled: true
                  inherited: false
                test-limit:
                  enabled: true
                  inherited: false
                weekly-report:
                  enabled: true
                  inherited: false
      deprecated: false
  /org/{orgId}/invite:
    post:
      tags:
        - Organizations
      summary: Invite users
      description: >-
        Invite users to the organization by email

        #### Required permissions


        - `View Organization`


        - `View Users`


        - `Invite Users`
      operationId: Inviteusers
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Inviteusersrequest'
                - example:
                    email: ''
            example:
              email: ''
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/members:
    get:
      tags:
        - Organizations
      summary: List Members
      description: >-
        Manage members in your organization

        #### Required permissions


        - `View Organization`


        - `View Users`
      operationId: ListMembers
      parameters:
        - name: orgId
          in: path
          description: The organization ID.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: includeGroupAdmins
          in: query
          description: Include group administrators who also have access to this organization.
          style: form
          explode: true
          schema:
            type: boolean
            example: true
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/ListMembersresponse'
                description: ''
                example:
                  - id: ''
                    name: ''
                    username: ''
                    email: ''
                    role: ''
              example:
                - id: ''
                  name: ''
                  username: ''
                  email: ''
                  role: ''
      deprecated: false
  /org/{orgId}/settings:
    get:
      tags:
        - Organizations
      summary: View organization settings
      description: >-
        #### Required permissions


        - `View Organization`
      operationId: Vieworganizationsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 25065eb1-109c-4c3e-9503-68fc56ef6f44
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Orgsettingsresponse'
                  - example:
                      requestAccess:
                        enabled: true
                      ignores:
                        reasonRequired: false
                        autoApproveIgnores: false
                        approvalWorkflowEnabled: false
              example:
                requestAccess:
                  enabled: true
                ignores:
                  reasonRequired: false
                  autoApproveIgnores: false
                  approvalWorkflowEnabled: false
      deprecated: false
    put:
      tags:
        - Organizations
      summary: Update organization settings
      description: >-
        Settings that are not provided will not be modified.


        #### Required permissions


        - `View Organization`


        - `Edit Organization`
      operationId: Updateorganizationsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 25065eb1-109c-4c3e-9503-68fc56ef6f44
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              type: string
              example: + Attributes (Org settings request)
            example: + Attributes (Org settings request)
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Orgsettingsresponse'
                  - example:
                      requestAccess:
                        enabled: true
              example:
                requestAccess:
                  enabled: true
        '403':
          description: If provided a setting that the `API_KEY` has no edit permission for.
          headers: {}
          content:
            application/json:
              schema:
                type: object
                description: If provided a setting that the `API_KEY` has no edit permission for.
      deprecated: false
  /org/{orgId}/members/{userId}:
    put:
      tags:
        - Organizations
      summary: Update a member in the organization
      description: >-
        Manage member's roles in your organization

        #### Required permissions


        - `Manage Users`
      operationId: Updateamemberintheorganization
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: userId
          in: path
          description: The user ID.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Updateamemberintheorganizationrequest'
                - example:
                    role: ''
            example:
              role: ''
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
    delete:
      tags:
        - Organizations
      summary: Remove a member from the organization
      description: >-
        Manage member's roles in your organization

        #### Required permissions


        - `View Organization`


        - `View Users`


        - `User Remove`
      operationId: Removeamemberfromtheorganization
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must admin have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: userId
          in: path
          description: The user ID we want to remove.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/members/update/{userId}:
    put:
      tags:
        - Organizations
      summary: Update a member's role in the organization
      description: >-
        Update member's role in your organization by role publicId

        #### Required permissions


        - `Manage Users`
      operationId: Updateamember'sroleintheorganization
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: userId
          in: path
          description: The user ID.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Updateamembersroleintheorganizationrequest'
                - example:
                    rolePublicId: ''
            example:
              rolePublicId: ''
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}:
    delete:
      tags:
        - Organizations
      summary: Remove organization
      description: >-
        #### Required permissions


        - `View Organization`


        - `Remove Organization`
      operationId: Removeorganization
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have permission to delete the provided organization. Currently this operation is only supported for organizations without any projects.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        
      responses:
        '204':
          description: ''
          headers: {}
          content: {}
      deprecated: false

  /org/{orgId}/provision:
    post:
      tags:
        - Organizations
      summary: Provision a user to the organization
      description: >-
        This endpoint allows Snyk Admins to provision user access to Snyk Orgs prior to the user login to the Snyk platform, and does not send out invitation emails to the Snyk platform. When the provisioned user logs into Snyk for the first time, the user will automatically be granted the appropriate Snyk org access and role permissions specified in the API call. This endpoint can be called multiple times to provision a user to multiple Snyk orgs. The API token used requires Org Admin permisisons, and must be part of a Snyk group with a valid SSO connection.  Service accounts are restricted from invoking this API. As this endpoint can only be used to provision new users, if a user has already logged into Snyk, this endpoint will not work to provision user access

        #### Required permissions

        - `Provision User`
      operationId: Provisionausertotheorganization
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must not exceed the permissions being granted to the provisioned user.
          required: true
          style: simple
          schema:
            type: string
            example: 25065eb1-109c-4c3e-9503-68fc56ef6f44
      requestBody:
        description: 'Details for user to be provisioned'
        content:
          application/json:
            schema:
              type: object
              properties:
                email:
                  type: string
                  description: The email of the user.
                  example: 'example@snyk.io'
                rolePublicId:
                  type: string
                  description: ID of the role to grant this user.
                  example: ''
                role: 
                  type: string
                  description: Deprecated. Name of the role to grant this user. Must be one of `ADMIN`, `COLLABORATOR`, or `RESTRICTED_COLLABORATOR`. This field is invalid if `rolePublicId` is supplied with the request.
                  example: ''
              required: 
                - email
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                type: object
                properties:
                  email:
                    type: string
                    description: The email of the user.
                    example: ''
                  role:
                    type: string
                    description: Name of the role granted for this user.
                    example: ''
                  rolePublicId:
                    type: string
                    description: ID of the role to granted for this user.
                    example: ''
                  created:
                    type: string
                    description: Timestamp of when this provision record was created.
                    example: ''
        '403':
          description: Provided `API_KEY` has no user provision permission or does not have permissions in role being provisioned.
          headers: {}
          content:
            application/json:
              schema:
                type: object
                description: Provided `API_KEY` has no user provision permission or does not have permissions in role being provisioned.
      deprecated: false
    get:
      tags:
        - Organizations
      summary: List pending user provisions
      description: >-
        This endpoint allows Snyk Admins to provision user access to Snyk Orgs prior to the user login to the Snyk platform, and does not send out invitation emails to the Snyk platform. When the provisioned user logs into Snyk for the first time, the user will automatically be granted the appropriate Snyk org access and role permissions specified in the API call. This endpoint can be called multiple times to provision a user to multiple Snyk orgs. The API token used requires Org Admin permisisons, and must be part of a Snyk group with a valid SSO connection.  Service accounts are restricted from invoking this API. As this endpoint can only be used to provision new users, if a user has already logged into Snyk, this endpoint will not work to provision user access

        #### Required permissions

        - `Provision User`
      operationId: Listpendinguserprovisions
      parameters:
        - name: orgId
          in: path
          description: The organization ID.
          required: true
          style: simple
          schema:
            type: string
            example: 25065eb1-109c-4c3e-9503-68fc56ef6f44
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Listpendinguserprovisionsresponse'
                description: ''
        '403':
          description: Provided `API_KEY` has no user provision permission or does not have permissions in role being provisioned.
          headers: {}
          content:
            application/json:
              schema:
                type: object
                description: Provided `API_KEY` has no user provision permission or does not have permissions in role being provisioned.
      deprecated: false
    delete:
      tags:
        - Organizations
      summary: Delete pending user provision
      description: >-
        This endpoint allows Snyk Admins to provision user access to Snyk Orgs prior to the user login to the Snyk platform, and does not send out invitation emails to the Snyk platform. When the provisioned user logs into Snyk for the first time, the user will automatically be granted the appropriate Snyk org access and role permissions specified in the API call. This endpoint can be called multiple times to provision a user to multiple Snyk orgs. The API token used requires Org Admin permisisons, and must be part of a Snyk group with a valid SSO connection.  Service accounts are restricted from invoking this API. As this endpoint can only be used to provision new users, if a user has already logged into Snyk, this endpoint will not work to provision user access

        #### Required permissions

        - `Provision User`
      operationId: Deletependinguserprovision
      parameters:
        - name: orgId
          in: path
          description: The organization ID.
          required: true
          style: simple
          schema:
            type: string
            example: 25065eb1-109c-4c3e-9503-68fc56ef6f44
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                type: object
                properties:
                  ok:
                    type: boolean
                    description: Deletion succeeded.
                    example: false
        '403':
          description: Provided `API_KEY` has no user provision permission or does not have permissions in role being provisioned.
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/integrations:
    get:
      tags:
        - Integrations
      summary: List
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Integrations`
      operationId: List
      parameters:
        - name: orgId
          in: path
          description: The organization public ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                type: object
                properties:
                  github:
                    type: string
                  gitlab:
                    type: string
                  bitbucket-cloud:
                    type: string
              example:
                github: 9a3e5d90-b782-468a-a042-9a2073736f0b
                gitlab: 1b3e3d90-c678-347a-n232-6a3453738h1e
                bitbucket-cloud: 6jje4c92-e7rn-t59a-f456-8n5675432fe9
      deprecated: false
    post:
      tags:
        - Integrations
      summary: Add new integration
      description: >-
        Add new integration for given organization.

        #### Required permissions

        - `View Organization`

        - `View Integrations`

        - `Edit Integrations`
      operationId: Addnewintegration
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/AddNewIntegrationWithCredentialsRequest'
                - $ref: '#/components/schemas/AddNewIntegrationWithBrokerRequest'
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Addnewintegrationresponse'
              example:
                id: 9a3e5d90-b782-468a-a042-9a2073736f0b
      deprecated: false
  /org/{orgId}/integrations/{integrationId}:
    put:
      tags:
        - Integrations
      summary: Update existing integration
      description: >-
        - Update integration’s credentials for given organization. Integration must be **not brokered**

        - Enable or disable brokered integration for given organization. *Credentials required for disabling brokered integration*

        Examples:

        - [Set up a broker for an existing integration](https://docs.snyk.io/snyk-api/api-endpoints-index-and-tips/examples-for-the-update-existing-integration-endpoint#set-up-broker-for-an-existing-integration)

        - [Update credentials for an existing non-brokered integration](https://docs.snyk.io/snyk-api/api-endpoints-index-and-tips/examples-for-the-update-existing-integration-endpoint#update-credentials-for-an-existing-non-brokered-integration)
        
        - [Disable broker for an existing integration](https://docs.snyk.io/snyk-api/api-endpoints-index-and-tips/examples-for-the-update-existing-integration-endpoint#disable-broker-for-an-existing-integration)

        #### Required permissions

        - `View Organization`

        - `View Integrations`

        - `Edit Integrations`
      operationId: Updateexistingintegration
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: integrationId
          in: path
          description: The unique identifier for the configured integration. This can be found on the [Integration page in the Settings area](https://app.snyk.io/manage/integrations) for all integrations that have been configured.
          required: true
          style: simple
          schema:
            type: string
            example: 9a3e5d90-b782-468a-a042-9a2073736f0b
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/Updateexistingintegrationrequest'
                - $ref: '#/components/schemas/Updateexistingintegrationrequest1'
                - $ref: '#/components/schemas/Updateexistingintegrationrequest2'
            examples:
              setupExistingIntegration:
                summary: Set up a broker for an existing integration
                value:
                  type: github
                  broker:
                    enabled: true
              updateCredentials:
                summary: Update credentials for an existing non-brokered integration
                value:
                  type: gitlab
                  credentials:
                    token: GITLAB_TOKEN
              disableBroker:
                summary: Disable broker for an existing integration
                value:
                  type: github
                  broker:
                    enabled: false
                  credentials:
                    token: GITHUB_TOKEN
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Updateexistingintegrationresponse'
                  - example:
                      id: 9a3e5d90-b782-468a-a042-9a2073736f0b
                      brokerToken: 4a18d42f-0706-4ad0-b127-24078731fbed
      deprecated: false
  /org/{orgId}/integrations/{integrationId}/authentication:
    delete:
      tags:
        - Integrations
      summary: Delete credentials
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Integrations`

        - `Edit Integrations`

        Removes any credentials set for this integration. If this is a brokered connection the operation will have no effect.
      operationId: Deletecredentials
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: integrationId
          in: path
          description: The integration ID.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/integrations/{integrationId}/authentication/provision-token:
    post:
      tags:
        - Integrations
      summary: Provision new broker token
      description: >-
        Issue a new and unique provisional broker token for the brokered integration.

        Used for zero down-time token rotation with the Snyk Broker. Once provisioned, the token can be used to initialize a new broker client before using the switch API to update the token in use by the integration.

        The new provisional token will fail to be created if the integration, or any other integration in the same group, already has one provisioned.

        #### Required permissions

        - `View Organization`

        - `View Integrations`

        - `Edit Integrations`
      operationId: Provisionnewbrokertoken
      parameters:
        - name: orgId
          in: path
          description: The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: integrationId
          in: path
          description: ''
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Provisionnewbrokertokenresponse'
              example:
                id: 9a3e5d90-b782-468a-a042-9a2073736f0b
                provisionalBrokerToken: 4a18d42f-0706-4ad0-b127-24078731fbed
      deprecated: false
  /org/{orgId}/integrations/{integrationId}/authentication/switch-token:
    post:
      tags:
        - Integrations
      summary: Switch between broker tokens
      description: >-
        Switch the existing broker token with the provisioned token for this integration and any other in the same group.

        Only perform this action when you have a Broker client running with the provisioned token.

        This action will fail if there is no token provisioned for this integration or any integration in the same group.

        #### Required permissions

        - `View Organization`

        - `View Integrations`

        - `Edit Integrations`
      operationId: Switchbetweenbrokertokens
      parameters:
        - name: orgId
          in: path
          description: The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: integrationId
          in: path
          description: ''
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/integrations/{integrationId}/clone:
    post:
      tags:
        - Integrations
      summary: Clone an integration (with settings and credentials)
      description: >-
        Clone an integration, including all of its settings and credentials from one organization to another organization in the same group.

        This API supports both brokered and non-brokered integrations.

        Use this API for when you want to share a Broker token between several Snyk organizations (integrations).

        #### Required permissions

        - `View Organization`

        - `View Integrations`

        - `Edit Integrations`
      operationId: Cloneanintegration(withsettingsandcredentials)
      parameters:
        - name: orgId
          in: path
          description: Source organization public ID to clone integration settings from. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: integrationId
          in: path
          description: Source integration public ID to clone.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cloneanintegrationwithsettingsandcredentialsrequest'
            example:
              destinationOrgPublicId: 9a3e5d90-b782-468a-a042-9a2073736f0b1
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cloneanintegrationwithsettingsandcredentialsresponse'
              example:
                newIntegrationId: 9a3e5d90-b782-468a-a042-9a2073736f0b
      deprecated: false
  /org/{orgId}/integrations/{type}:
    get:
      tags:
        - Integrations
      summary: Get existing integration by type
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Integrations`
      operationId: Getexistingintegrationbytype
      parameters:
        - name: orgId
          in: path
          description: The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: type
          in: path
          description: Integration type.
          required: true
          style: simple
          schema:
            $ref: '#/components/schemas/IntegrationType'
          example: github
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Getexistingintegrationbytyperesponse'
              example:
                id: 9a3e5d90-b782-468a-a042-9a2073736f0b
      deprecated: false
  /org/{orgId}/integrations/{integrationId}/settings:
    get:
      tags:
        - Integrations
      summary: Get Integration Settings
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Integrations`
      operationId: Retrieve
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: integrationId
          in: path
          description: The unique identifier for the configured integration. This can be found on the [Integration page in the Settings area](https://app.snyk.io/manage/integrations) for all integrations that have been configured.
          required: true
          style: simple
          schema:
            type: string
            example: 9a3e5d90-b782-468a-a042-9a2073736f0b
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Integrationsettings'
      deprecated: false
    put:
      tags:
        - Integrations
      summary: Update Integration Settings
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Integrations`

        - `Edit Integrations`
      operationId: Update
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: integrationId
          in: path
          description: The unique identifier for the configured integration. This can be found on the [Integration page in the Settings area](https://app.snyk.io/manage/integrations) for all integrations that have been configured.
          required: true
          style: simple
          schema:
            type: string
            example: 9a3e5d90-b782-468a-a042-9a2073736f0b
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Integrationsettings'
            example:
              autoDepUpgradeLimit: 2
              autoDepUpgradeIgnoredDependencies: []
              autoDepUpgradeEnabled: false
              autoDepUpgradeMinAge: 21
              pullRequestTestCodeEnabled: true
              pullRequestTestCodeSeverity: high
              pullRequestTestEnabled: true
              pullRequestFailOnAnyVulns: false
              pullRequestFailOnlyForHighSeverity: true
              pullRequestAssignment: '{"enabled":true,"type":"manual","assignees":["username"]}'
              autoRemediationPrs:
                backlogPrsEnabled: false
                backlogPrStrategy: vuln
                freshPrsEnabled: true
                usePatchRemediation: false
              manualRemediationPrs:
                useManualPatchRemediation: false
              dockerfileSCMEnabled: true
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Integrationsettings'
              example:
                autoDepUpgradeLimit: 2
                autoDepUpgradeIgnoredDependencies: []
                autoDepUpgradeEnabled: false
                autoDepUpgradeMinAge: 21
                pullRequestTestCodeEnabled: true
                pullRequestTestCodeSeverity: high
                pullRequestTestEnabled: true
                pullRequestFailOnAnyVulns: false
                pullRequestFailOnlyForHighSeverity: true
                pullRequestAssignment: '{"enabled":true,"type":"manual","assignees":["username"]}'
                autoRemediationPrs:
                  backlogPrsEnabled: false
                  backlogPrStrategy: vuln
                  freshPrsEnabled: true
                  usePatchRemediation: false
                manualRemediationPrs:
                  useManualPatchRemediation: false
                dockerfileSCMEnabled: true
      deprecated: false
  /org/{orgId}/integrations/{integrationId}/import:
    post:
      tags:
        - Import Projects
      summary: Import targets
      description: Request a [target](https://docs.snyk.io/getting-started/introduction-to-snyk-projects#targets) to be analyzed for supported Snyk projects via a configured [integration](https://docs.snyk.io/integrations). See the [Integrations API](https://docs.snyk.io/snyk-api/reference/integrations-v1) to configure a new integration.
      operationId: Importtargets
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: integrationId
          in: path
          description: The unique identifier for the configured integration. This can be found on the [Integration page in the Settings area](https://app.snyk.io/manage/integrations) for all integrations that have been configured.
          required: true
          style: simple
          schema:
            type: string
            example: 9a3e5d90-b782-468a-a042-9a2073736f0b
      requestBody:
        description: 'Note: Importing targets through a Github (Cloud) integration requires the use of a [Snyk personal access/api token](https://app.snyk.io/account).'
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/GithubAndGithubEnterpriseImportRequest'
                - $ref: '#/components/schemas/AzureReposImportRequest'
                - $ref: '#/components/schemas/GitLabImportRequest'
                - $ref: '#/components/schemas/BitbucketCloudImportRequest'
                - $ref: '#/components/schemas/BitbucketServerImportRequest'
                - $ref: '#/components/schemas/HerokoImportRequest'
                - $ref: '#/components/schemas/AWSLambdaImportRequest'
                - $ref: '#/components/schemas/CloudFoundryPivotalIBMCloudImportRequest'
                - $ref: '#/components/schemas/DockerHubImportRequest'
                - $ref: '#/components/schemas/AzureCRElasticCRArtifactoryCRNexusImportRequest'
                - $ref: '#/components/schemas/GoogleCRGoogleARHarborDigitalOceanCRQuayGitlabCRGithubCRImportRequest'
        required: true
      responses:
        '201':
          description: ''
          headers:
            Location:
              schema:
                type: string
              example: URL for the status API call of the import
          content: {}
      deprecated: false
  /org/{orgId}/integrations/{integrationId}/import/{jobId}:
    get:
      tags:
        - Import Projects
      summary: Get import job details
      description: 'Get import job details'
      operationId: Getimportjobdetails
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have admin access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: integrationId
          in: path
          description: The unique identifier for the configured integration. This can be found on the [Integration page in the Settings area](https://app.snyk.io/manage/integrations) for all integrations that have been configured.
          required: true
          style: simple
          schema:
            type: string
            example: 9a3e5d90-b782-468a-a042-9a2073736f0b
        - name: jobId
          in: path
          description: The ID of the job. This can be found in the Location response header from the corresponding POST request that triggered the import job.
          required: true
          style: simple
          schema:
            type: string
            example: 1a325d9d-b782-468a-a242-9a2073734f0b
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Getimportjobdetailsresponse'
              example:
                id: dce061f7-ce0f-4ccf-b49b-4335d1205bd9
                status: pending
                created: 2018-07-23T15:21:10.611Z
                logs:
                  - name: org1/repo1
                    created: 2018-07-23T15:21:10.643Z
                    status: failed
                    projects: []
                  - name: org2/repo2
                    created: 2018-07-23T15:21:10.644Z
                    status: complete
                    projects:
                      - targetFile: package.json
                        success: true
                        projectUrl: https://api.snyk.io/v1/org/org-name/project/7eeaee25-5f9b-4d05-8818-4cca2c9d9adc
                  - name: org3/repo3
                    created: 2018-07-23T15:21:10.643Z
                    status: pending
                    projects:
                      - targetFile: package.json
                        success: true
                        projectUrl: https://api.snyk.io/v1/org/org-name/project/0382897c-0617-4429-86df-51187dfd42f6
      deprecated: false

  /org/{orgId}/project/{projectId}:
    get:
      tags:
        - Projects
      summary: Retrieve a single project
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`

        - `View Project Snapshot`
      operationId: Retrieveasingleproject
      parameters:
        - name: orgId
          in: path
          description: The organization ID the project belongs to. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Project'
      deprecated: false
    put:
      tags:
        - Projects
      summary: Update a project
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`

        - `Edit Project`
      operationId: Updateaproject
      parameters:
        - name: orgId
          in: path
          description: The organization ID the project belongs to. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Updateaprojectrequest'
            example:
              owner:
                id: 1acd4d09-5602-4d04-9640-045fe928aaea
              branch: main
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Project'
      deprecated: false
    delete:
      tags:
        - Projects
      summary: Delete a project
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`

        - `Remove Project`
      operationId: Deleteaproject
      parameters:
        - name: orgId
          in: path
          description: The organization ID the project belongs to. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/project/{projectId}/deactivate:
    post:
      tags:
        - Projects
      summary: Deactivate a project
      description: >-
        Deactivating a project will:

        - Disable pull request tests for new vulnerabilities.

        - Disable Fix pull request from being opened for newly disclosed vulnerabilities.

        - Disable recurring tests - email alerts about newly disclosed vulnerabilities will be turned off.

        - If the repository has no other active projects, then remove any webhooks related to the project.

        #### Required permissions

        - `View Organization`

        - `View Project`

        - `Project Status`
      operationId: Deactivate
      parameters:
        - name: orgId
          in: path
          description: The organization ID the project belongs to. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/project/{projectId}/activate:
    post:
      tags:
        - Projects
      summary: Activate a project
      description: >-
        Activating a project will:

        - Add a repository webhook for supported integrations.

        - Enable pull request tests for new vulnerabilities.

        - Open Fix pull request for newly disclosed vulnerabilities.

        - Enable recurring tests, sending email alerts about newly disclosed vulnerabilities.

        #### Required permissions

        - `View Organization`

        - `View Project`

        - `Project Status`
      operationId: Activate
      parameters:
        - name: orgId
          in: path
          description: The organization ID the project belongs to. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/project/{projectId}/aggregated-issues:
    post:
      tags:
        - Projects
      summary: List all Aggregated issues
      description: >-
        #### Required permissions

        - `View Project`

        - `View Project Snapshot`
      operationId: ListallAggregatedissues
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to return issues for.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Aggregatedprojectissuesfilters'
            example:
              includeDescription: false
              includeIntroducedThrough: false
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Aggregatedprojectissues'
      deprecated: false
  /org/{orgId}/project/{projectId}/issue/{issueId}/paths:
    get:
      tags:
        - Projects
      summary: List all project issue paths
      description: >-
        #### Required permissions

        - `View Project`

        - `View Project Snapshot`
      operationId: Listallprojectissuepaths
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID for which to return issue paths.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
        - name: issueId
          in: path
          description: The issue ID for which to return issue paths.
          required: true
          style: simple
          schema:
            type: string
            example: SNYK-JS-LODASH-590103
        - name: snapshotId
          in: query
          description: The project snapshot ID for which to return issue paths. If set to `latest`, the most recent snapshot will be used. Use the "List all project snapshots" endpoint to find suitable values for this.
          style: form
          explode: true
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454553
        - name: perPage
          in: query
          description: The number of results to return per page (1 - 1000, inclusive).
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 3
        - name: page
          in: query
          description: The page of results to return.
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 2
      responses:
        '200':
          description: ''
          headers:
            Link:
              content:
                text/plain:
                  schema:
                    type: string
                  example: <https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/issue/SNYK-JS-LODASH-590103?snapshotId=6d5813be-7e6d-4ab8-80c2-1e3e2a454553&page=1&perPage=3>; rel=prev, <https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/issue/SNYK-JS-LODASH-590103?snapshotId=6d5813be-7e6d-4ab8-80c2-1e3e2a454553&page=3&perPage=3>; rel=next, <https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/issue/SNYK-JS-LODASH-590103?snapshotId=6d5813be-7e6d-4ab8-80c2-1e3e2a454553&page=4&perPage=3>; rel=last
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Issuepaths'
              example:
                snapshotId: 6d5813be-7e6d-4ab8-80c2-1e3e2a454553
                paths:
                  - - name: tap
                      version: 11.1.5
                    - name: nyc
                      version: 11.9.0
                    - name: istanbul-lib-instrument
                      version: 1.10.1
                    - name: babel-traverse
                      version: 6.26.0
                    - name: lodash
                      version: 4.17.10
                  - - name: tap
                      version: 11.1.5
                      fixVersion: 11.1.5
                    - name: nyc
                      version: 11.9.0
                    - name: istanbul-lib-instrument
                      version: 1.10.1
                    - name: babel-template
                      version: 6.26.0
                    - name: lodash
                      version: 4.17.10
                total: 10
                links:
                  prev: https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/issue/SNYK-JS-LODASH-590103?snapshotId=6d5813be-7e6d-4ab8-80c2-1e3e2a454553&page=1&perPage=3
                  next: https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/issue/SNYK-JS-LODASH-590103?snapshotId=6d5813be-7e6d-4ab8-80c2-1e3e2a454553&page=3&perPage=3
                  last: https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/issue/SNYK-JS-LODASH-590103?snapshotId=6d5813be-7e6d-4ab8-80c2-1e3e2a454553&page=4&perPage=3
      deprecated: false
  /org/{orgId}/project/{projectId}/history:
    post:
      tags:
        - Projects
      x-snyk-documentation:
        category: Snapshots
      summary: List all project snapshots
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`

        - `View Project Snapshot`
      operationId: Listallprojectsnapshots
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to return snapshots for.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
        - name: perPage
          in: query
          description: The number of results to return (the default is 10, the maximum is 100).
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 10
        - name: page
          in: query
          description: The offset from which to start returning results from.
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 1
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Projectsnapshotsfilters'
            example:
              filters:
                imageId: sha256:a368cbcfa6789bc347345f6d78902afe138b62ff5373d2aa5f37120277c90a67
        required: true
      responses:
        '200':
          description: ''
          headers:
            Link:
              content:
                text/plain:
                  schema:
                    type: string
                  example: <https://api.snyk.io/v1/org/2d5c4d0c-c6d6-4658-a703-c2721c135b26/project/84dc70ad-eea9-468d-ae43-f0966ba12c99/history?page=3&perPage=100>; rel=last, <https://api.snyk.io/v1/org/2d5c4d0c-c6d6-4658-a703-c2721c135b26/project/84dc70ad-eea9-468d-ae43-f0966ba12c99/history?page=2&perPage=100>; rel=next
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Projectsnapshots'
              example:
                snapshots:
                  - id: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
                    created: 2019-02-05T06:21:00.000Z
                    totalDependencies: 438
                    issueCounts:
                      vuln:
                        low: 8
                        medium: 15
                        high: 13
                        critical: 0
                      license:
                        low: 8
                        medium: 15
                        high: 13
                        critical: 0
                    imageId: sha256:a368cbcfa6789bc347345f6d78902afe138b62ff5373d2aa5f37120277c90a67
                    imageTag: latest
                    imagePlatform: linux/amd64
                    baseImageName: fedora:32
                    method: web-test
                total: 1
      deprecated: false
  /org/{orgId}/project/{projectId}/history/{snapshotId}/aggregated-issues:
    post:
      tags:
        - Projects
      x-snyk-documentation:
        category: Snapshots
      summary: List all project snapshot aggregated issues
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`

        - `View Project Snapshot`
      operationId: Listallprojectsnapshotaggregatedissues
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 2d5c4d0c-c6d6-4658-a703-c2721c135b26
        - name: projectId
          in: path
          description: The project ID.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
        - name: snapshotId
          in: path
          description: The snapshot ID. If set to latest, the most recent snapshot will be used.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454553
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Aggregatedprojectissuesfilters'
            example:
              includeDescription: false
              includeIntroducedThrough: false
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Aggregatedprojectissues'
      deprecated: false
  /org/{orgId}/project/{projectId}/history/{snapshotId}/issue/{issueId}/paths:
    get:
      tags:
        - Projects
      x-snyk-documentation:
        category: Snapshots
      summary: List all project snapshot issue paths
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`

        - `View Project Snapshot`
      operationId: Listallprojectsnapshotissuepaths
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID for which to return issue paths.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
        - name: snapshotId
          in: path
          description: The project snapshot ID for which to return issue paths. If set to `latest`, the most recent snapshot will be used. Use the "List all project snapshots" endpoint to find suitable values for this.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454553
        - name: issueId
          in: path
          description: The issue ID for which to return issue paths.
          required: true
          style: simple
          schema:
            type: string
            example: SNYK-JS-LODASH-590103
        - name: perPage
          in: query
          description: The number of results to return per page (1 - 1000, inclusive).
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 3
        - name: page
          in: query
          description: The page of results to return.
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 2
      responses:
        '200':
          description: ''
          headers:
            Link:
              schema:
                type: string
              example: <https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/history/6d5813be-7e6d-4ab8-80c2-1e3e2a454553/issue/SNYK-JS-LODASH-590103?page=1&perPage=3>; rel=prev, <https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/history/6d5813be-7e6d-4ab8-80c2-1e3e2a454553/issue/SNYK-JS-LODASH-590103?page=3&perPage=3>; rel=next, <https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/history/6d5813be-7e6d-4ab8-80c2-1e3e2a454553/issue/SNYK-JS-LODASH-590103?page=4&perPage=3>; rel=last
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Issuepaths'
              example:
                snapshotId: 6d5813be-7e6d-4ab8-80c2-1e3e2a454553
                paths:
                  - - name: tap
                      version: 11.1.5
                    - name: nyc
                      version: 11.9.0
                    - name: istanbul-lib-instrument
                      version: 1.10.1
                    - name: babel-traverse
                      version: 6.26.0
                    - name: lodash
                      version: 4.17.10
                  - - name: tap
                      version: 11.1.5
                      fixVersion: 11.1.5
                    - name: nyc
                      version: 11.9.0
                    - name: istanbul-lib-instrument
                      version: 1.10.1
                    - name: babel-template
                      version: 6.26.0
                    - name: lodash
                      version: 4.17.10
                total: 10
                links:
                  prev: https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/history/6d5813be-7e6d-4ab8-80c2-1e3e2a454553/issue/SNYK-JS-LODASH-590103?page=1&perPage=3
                  next: https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/history/6d5813be-7e6d-4ab8-80c2-1e3e2a454553/issue/SNYK-JS-LODASH-590103?page=3&perPage=3
                  last: https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/6d5813be-7e6d-4ab8-80c2-1e3e2a454545/history/6d5813be-7e6d-4ab8-80c2-1e3e2a454553/issue/SNYK-JS-LODASH-590103?page=4&perPage=3
      deprecated: false
  /org/{orgId}/project/{projectId}/dep-graph:
    get:
      tags:
        - Projects
      summary: Get Project dependency graph
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`

        - `View Project Snapshot`
      operationId: GetProjectdependencygraph
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to return issues for.
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
      responses:
        '200':
          description: >-
            * A reference implementation of the graph, as well as conversion functions to/from legacy tree format, can be found at: https://github.com/snyk/dep-graph.

            * The object might contain additional fields in the future, in a backward-compatible way (`schemaVersion` will change accordingly).
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Projectdependencygraph'
              example:
                depGraph:
                  schemaVersion: 1.1.0
                  pkgManager:
                    name: npm
                  pkgs:
                    - id: demo-app-for-test@1.1.1
                      info:
                        name: demo-app-for-test
                        version: 1.1.1
                    - id: express@4.4.0
                      info:
                        name: express
                        version: 4.4.0
                    - id: ws@1.0.0
                      info:
                        name: ws
                        version: 1.0.0
                  graph:
                    rootNodeId: root-node
                    nodes:
                      - nodeId: root-node
                        pkgId: demo-app-for-test@1.1.1
                        deps:
                          - nodeId: express@4.4.0
                          - nodeId: ws@1.0.0
                      - nodeId: express@4.4.0
                        pkgId: express@4.4.0
                        deps: []
                      - nodeId: ws@1.0.0
                        pkgId: ws@1.0.0
                        deps: []
      deprecated: false
  /org/{orgId}/project/{projectId}/ignores:
    get:
      tags:
        - Projects
      x-snyk-documentation:
        category: Ignores
      summary: List all ignores
      description: >-
        Ignores from `.snyk` files are not included here.

        Ignores from Policies are not included here.

        Temporary ignores include an `expires` attribute, while permanent ignores do not.

        #### Required permissions

        - `View Organization`

        - `View Project`

        - `View Project Ignores`
      operationId: Listallignores
      parameters:
        - name: orgId
          in: path
          description: The organization ID to list ignores for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to list ignores for.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Allignores'
      deprecated: false
  /org/{orgId}/project/{projectId}/ignore/{issueId}:
    get:
      tags:
        - Projects
      x-snyk-documentation:
        category: Ignores
      summary: Retrieve ignore
      description: >-
        It is possible to modify/retrieve ignored vulnerability or license issues for a given organization and project.

        Ignores from `.snyk` files are not included here

        #### Required permissions

        - `View Project`

        - `View Project Ignores`
      operationId: Retrieveignore
      parameters:
        - name: orgId
          in: path
          description: The organization ID to modify ignores for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to modify ignores for.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
        - name: issueId
          in: path
          description: The issue ID to modify ignores for. Can be a vulnerability or a license Issue.
          required: true
          style: simple
          schema:
            type: string
            example: SNYK-JS-QS-10019
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Ignore'
      deprecated: false
    post:
      tags:
        - Projects
      x-snyk-documentation:
        category: Ignores
      summary: Add ignore
      description: >-
        It is possible to modify/retrieve ignored vulnerability or license issues for a given organization and project.

        Ignores from `.snyk` files are not included here

        #### Required permissions

        - `View Organization`

        - `View Project Ignores`

        - `Create new project ignores`
      operationId: Addignore
      parameters:
        - name: orgId
          in: path
          description: The organization ID to modify ignores for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to modify ignores for.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
        - name: issueId
          in: path
          description: The issue ID to modify ignores for. Can be a vulnerability or a license Issue.
          required: true
          style: simple
          schema:
            type: string
            example: SNYK-JS-QS-10019
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Ignorerule'
            example:
              ignorePath: ''
              reason: ''
              reasonType: not-vulnerable
              disregardIfFixable: false
              expires: ''
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Ignore'
      deprecated: false
    put:
      tags:
        - Projects
      x-snyk-documentation:
        category: Ignores
      summary: Replace ignores
      description: >-
        It is possible to modify/retrieve ignored vulnerability or license issues for a given organization and project.

        Ignores from `.snyk` files are not included here

        #### Required permissions

        - `View Organization`

        - `View Project Ignores`

        - `Edit Project Ignores`
      operationId: Replaceignores
      parameters:
        - name: orgId
          in: path
          description: The organization ID to modify ignores for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to modify ignores for.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
        - name: issueId
          in: path
          description: The issue ID to modify ignores for. Can be a vulnerability or a license Issue.
          required: true
          style: simple
          schema:
            type: string
            example: SNYK-JS-QS-10019
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              type: array
              items:
                $ref: '#/components/schemas/Ignorerules'
            example:
              - ignorePath: ''
                reason: ''
                reasonType: not-vulnerable
                disregardIfFixable: false
                expires: ''
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Ignore'
      deprecated: false
    delete:
      tags:
        - Projects
      x-snyk-documentation:
        category: Ignores
      summary: Delete ignores
      description: >-
        It is possible to modify/retrieve ignored vulnerability or license issues for a given organization and project.

        Ignores from `.snyk` files are not included here

        #### Required permissions

        - `View Organization`

        - `View Project Ignores`

        - `Remove Project Ignores`
      operationId: Deleteignores
      parameters:
        - name: orgId
          in: path
          description: The organization ID to modify ignores for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to modify ignores for.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
        - name: issueId
          in: path
          description: The issue ID to modify ignores for. Can be a vulnerability or a license Issue.
          required: true
          style: simple
          schema:
            type: string
            example: SNYK-JS-QS-10019
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/project/{projectId}/jira-issues:
    get:
      tags:
        - Projects
      x-snyk-documentation:
        category: Jira
      summary: List all jira issues
      description: >-
        If you have configured an integration with Jira, it is possible to create Jira issues for project vulnerabilities or license issues directly from the Snyk API.

        The Jira integration is available to customers on the pro or enterprise plan.

        At the moment, the usage of the Jira integration via the API is not supported for Snyk Infrastructure as Code

        #### Required permissions

        - `View Jira issues`
      operationId: Listalljiraissues
      parameters:
        - name: orgId
          in: path
          description: The organization ID to list Jira issues for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to list Jira issues for.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alljiraissues'
      deprecated: false
  /org/{orgId}/project/{projectId}/issue/{issueId}/jira-issue:
    post:
      tags:
        - Projects
      x-snyk-documentation:
        category: Jira
      summary: Create jira issue
      description: >-
        If you have configured an integration with Jira, it is possible to create Jira issues for project vulnerabilities or license issues directly from the Snyk API.

        The Jira integration is available to customers on the pro or enterprise plan.

        At the moment, the usage of the Jira integration via the API is not supported for Snyk Infrastructure as Code

        #### Required permissions

        - `Create Jira issues`
      operationId: Createjiraissue
      parameters:
        - name: orgId
          in: path
          description: The organization ID to list Jira issues for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to list Jira issues for.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
        - name: issueId
          in: path
          description: The issue ID to create Jira issue for.
          required: true
          style: simple
          schema:
            type: string
            example: npm:qs:20140806-1
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Jiraissuerequest'
            example:
              fields:
                project: {}
                issuetype: {}
                summary: ''
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Jiraissue'
              example:
                jiraIssue:
                  id: '10001'
                  key: EX-1
      deprecated: false
  /org/{orgId}/project/{projectId}/settings:
    get:
      tags:
        - Projects
      summary: List project settings
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`
      operationId: Listprojectsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID to which the project belongs. The API_KEY must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      responses:
        '200':
          description: The response will contain only attributes that can be updated (see `ATTRIBUTES` section in `Update project settings`) and that have been previously set.
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Projectsettings'
              example:
                autoDepUpgradeLimit: 2
                autoDepUpgradeIgnoredDependencies:
                  - tap
                  - ava
                autoDepUpgradeEnabled: false
                autoDepUpgradeMinAge: 21
                pullRequestFailOnAnyVulns: false
                pullRequestFailOnlyForHighSeverity: true
                pullRequestTestEnabled: true
                pullRequestAssignment: '{"enabled":true,"type":"manual","assignees":["username"]}'
                autoRemediationPrs: '{"freshPrsEnabled":true,"backlogPrsEnabled":false,"usePatchRemediation":true}'
      deprecated: false
    put:
      tags:
        - Projects
      summary: Update project settings
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`

        - `Edit Project`
      operationId: Updateprojectsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID to which the project belongs. The API_KEY must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Projectsettings'
            example:
              autoDepUpgradeLimit: 2
              autoDepUpgradeIgnoredDependencies:
                - tap
                - ava
              autoDepUpgradeEnabled: false
              autoDepUpgradeMinAge: 21
              pullRequestFailOnAnyVulns: false
              pullRequestFailOnlyForHighSeverity: true
              pullRequestTestEnabled: true
              pullRequestAssignment: '{"enabled":true,"type":"manual","assignees":["username"]}'
              autoRemediationPrs: '{"freshPrsEnabled":true,"backlogPrsEnabled":false,"usePatchRemediation":false}'
        required: true
      responses:
        '200':
          description: The response will contain the attributes and values that have been sent in the request and successfully updated.
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Projectsettings'
              example:
                autoDepUpgradeLimit: 2
                autoDepUpgradeIgnoredDependencies:
                  - tap
                  - ava
                autoDepUpgradeEnabled: false
                autoDepUpgradeMinAge: 21
                pullRequestTestEnabled: true
                pullRequestFailOnAnyVulns: false
                pullRequestFailOnlyForHighSeverity: true
                pullRequestAssignment: '{"enabled":true,"type":"manual","assignees":["username"]}'
                autoRemediationPrs: '{"freshPrsEnabled":true,"backlogPrsEnabled":false,"usePatchRemediation":false}'
      deprecated: false
    delete:
      tags:
        - Projects
      summary: Delete project settings
      description: >-
        Deleting project settings will set the project to inherit default settings from its integration.

        #### Required permissions

        - `View Organization`

        - `View Project`

        - `Edit Project`
      operationId: Deleteprojectsettings
      parameters:
        - name: orgId
          in: path
          description: The organization ID to which the project belongs. The API_KEY must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      responses:
        '204':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/project/{projectId}/move:
    put:
      tags:
        - Projects
      summary: Move project to a different organization
      description: >-
        Note: when moving a project to a new organization, the historical data used for reporting does not move with it.

        #### Required permissions

        - `View Organization`

        - `View Project`

        - `Move Project`
      operationId: Moveprojecttoadifferentorganization
      parameters:
        - name: orgId
          in: path
          description: The organization ID to which the project belongs. The API_KEY must have group admin permissions. If the project is moved to a new group, a personal level API key is needed.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Projectmove'
            example:
              targetOrgId: 4a18d42f-0706-4ad0-b127-24078731fbed
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Moveprojecttoadifferentorganizationresponse'
              example:
                originOrg: 4a18d42f-0706-4ad0-b127-24078731fbed
                destinationOrg: 4a18d42f-0706-4ad0-b127-24078731fbed
                movedProject: 463c1ee5-31bc-428c-b451-b79a3270db08
      deprecated: false
  /org/{orgId}/project/{projectId}/tags:
    post:
      tags:
        - Projects
      summary: Add a tag to a project
      description: >-
        #### Required permissions

        - Group Admin
      operationId: Addatagtoaproject
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to apply the tag to
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Tag'
            example:
              key: example-tag-key
              value: example-tag-value
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Addatagtoaprojectresponse'
              example:
                tags:
                  - key: example-tag-key
                    value: example-tag-value
      deprecated: false
  /org/{orgId}/project/{projectId}/tags/remove:
    post:
      tags:
        - Projects
      summary: Remove a tag from a project
      description: >-
        #### Required permissions

        - Group Admin
      operationId: Removeatagfromaproject
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to remove a tag from
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Tag'
            example:
              key: example-tag-key
              value: example-tag-value
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Removeatagfromaprojectresponse'
              example:
                tags:
                  - key: example-tag-key
                    value: example-tag-value
      deprecated: false
  /org/{orgId}/project/{projectId}/attributes:
    post:
      tags:
        - Projects
      summary: Applying attributes
      description: >-
        Attributes are static and non-configurable fields which allow to add additional metadata to a project.

        Attributes have a pre-defined list of values that a user can select from.


        | Business criticality | Environment | Lifecycle stage |

        |:--------------------:|:-----------:|:---------------:|

        |       critical       |   frontend  |    production   |

        |         high         |   backend   |   development   |

        |        medium        |   internal  |     sandbox     |

        |          low         |   external  |                 |

        |                      |    mobile   |                 |

        |                      |     saas    |                 |

        |                      |    onprem   |                 |

        |                      |    hosted   |                 |

        |                      | distributed |                 |

        Applies an attribute to the provided project.

        It is possible to assign multiple values to each attribute, but you can only assign values to one of the predefined attribute categories, using the predefined options for this category.

        Assigning an attribute requires the caller to be either an Organization Administrator or a Group Administrator.

        Assigning an attribute will override any existing values that the specific attribute already has set.

        In order to clear out an attribute value, an empty array can be set.


        > **Note:** Organization admins can add an attribute to a Project. However, only Group admins can modify Project attributes in cases where attributes match a policy, because policies can only be managed by Group admins.


        #### Required permissions

        - `View Organization`

        - `View Project`

        - `Edit Project Attributes`
      operationId: Applyingattributes
      parameters:
        - name: orgId
          in: path
          description: The organization ID. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: projectId
          in: path
          description: The project ID to remove a tag from
          required: true
          style: simple
          schema:
            type: string
            example: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Projectattributes'
            example:
              criticality:
                - high
              environment:
                - backend
              lifecycle:
                - development
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Applyingattributesresponse'
              example:
                attributes:
                  criticality:
                    - high
                  environment:
                    - backend
                  lifecycle:
                    - development
      deprecated: false
  /org/{orgId}/dependencies:
    post:
      tags:
        - Dependencies
      summary: List all dependencies
      description: >-
        Dependencies are packages/modules that your projects depend on.

        Current rate limit is up to 150 requests per minute, per user.

        #### Required permissions

        - `View Organization`

        - `View Project`

        - `View Project Snapshot`
      operationId: Listalldependencies
      parameters:
        - name: orgId
          in: path
          description: The organization ID to list projects for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: sortBy
          in: query
          description: The field to sort results by.
          style: form
          explode: true
          schema:
            $ref: '#/components/schemas/sortBy'
          example: dependency
        - name: order
          in: query
          description: The direction to sort results by.
          style: form
          explode: true
          schema:
            $ref: '#/components/schemas/order'
        - name: page
          in: query
          description: The page of results to fetch.
          style: form
          explode: true
          schema:
            type: number
            format: double
        - name: perPage
          in: query
          description: The number of results to fetch per page (maximum is 1000).
          style: form
          explode: true
          schema:
            type: number
            format: double
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Dependenciesfilters'
            example:
              filters:
                languages:
                  - cpp
                  - dockerfile
                  - dotnet
                  - elixir
                  - golang
                  - helm
                  - java
                  - javascript
                  - kubernetes
                  - linux
                  - php
                  - python
                  - ruby
                  - scala
                  - swift
                  - terraform
                projects: []
                dependencies: []
                licenses: []
                severity:
                  - critical
                  - high
                  - medium
                  - low
                depStatus: ''
        required: true
      responses:
        '200':
          description: ''
          headers:
            Link:
              schema:
                type: string
              example: <https://api.snyk.io/v1/org/4a18d42f-0706-4ad0-b127-24078731fbed/dependencies?order=asc&page=1&perPage=20&sortBy=dependency>; rel=last
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Dependencies'
              example:
                results:
                  - id: gulp@3.9.1
                    name: gulp
                    version: 3.9.1
                    latestVersion: 4.0.0
                    latestVersionPublishedDate: 2018-01-01T01:29:06.863Z
                    firstPublishedDate: 2013-07-04T23:27:07.828Z
                    isDeprecated: false
                    deprecatedVersions:
                      - 0.0.1
                      - 0.0.2
                      - 0.0.3
                    licenses:
                      - id: snyk:lic:npm:gulp:MIT
                        title: MIT license
                        license: MIT
                    dependenciesWithIssues:
                      - minimatch@2.0.10
                      - minimatch@0.2.14
                    type: npm
                    projects:
                      - name: atokeneduser/goof
                        id: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
                total: 1
      deprecated: false
  /org/{orgId}/licenses:
    post:
      tags:
        - Licenses
      summary: List all licenses
      description: >-
        #### Required permissions

        - `View Organization`

        - `View Project`

        - `View Project Snapshot`
      operationId: Listalllicenses
      parameters:
        - name: orgId
          in: path
          description: The organization ID to list projects for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: sortBy
          in: query
          description: The field to sort results by.
          style: form
          explode: true
          schema:
            allOf:
              - $ref: '#/components/schemas/sortBy1'
              - description: The field to sort results by.
                example: license
        - name: order
          in: query
          description: The direction to sort results by.
          style: form
          explode: true
          schema:
            allOf:
              - $ref: '#/components/schemas/order'
              - description: The direction to sort results by.
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Licensesfilters'
            example:
              filters:
                languages:
                  - node
                  - ruby
                  - java
                  - cpp
                projects: []
                dependencies: []
                licenses: []
                severity:
                  - none
                  - high
                  - medium
                  - low
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Licenses'
                  - example:
                      results:
                        - id: MIT
                          severity: none
                          instructions: ''
                          dependencies:
                            - id: accepts@1.0.0
                              name: accepts
                              version: 1.0.0
                              packageManager: npm
                          projects:
                            - name: atokeneduser/goof
                              id: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
                      total: 1
              example:
                results:
                  - id: MIT
                    severity: none
                    instructions: ''
                    dependencies:
                      - id: accepts@1.0.0
                        name: accepts
                        version: 1.0.0
                        packageManager: npm
                    projects:
                      - name: atokeneduser/goof
                        id: 6d5813be-7e6d-4ab8-80c2-1e3e2a454545
                total: 1
      deprecated: false
  /org/{orgId}/entitlements:
    get:
      tags:
        - Entitlements
      summary: List all entitlements
      description: >-
        #### Required permissions


        - `View Organization`


        - `View Entitlements`
      operationId: Listallentitlements
      parameters:
        - name: orgId
          in: path
          description: The organization ID to list entitlements for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Listallentitlementsresponse'
                  - example:
                      licenses: true
                      reports: true
                      fullVulnDB: false
              example:
                licenses: true
                reports: true
                fullVulnDB: false
      deprecated: false
  /org/{orgId}/entitlement/{entitlementKey}:
    get:
      tags:
        - Entitlements
      summary: Get an organization's entitlement value
      description: >-
        It is possible to query an organization for a specific entitlement, getting its value

        #### Required permissions


        - `View Organization`


        - `View Entitlements`
      operationId: Getanorganization'sentitlementvalue
      parameters:
        - name: orgId
          in: path
          description: The organization ID to query the entitlement for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: entitlementKey
          in: path
          description: The entitlement to query.
          required: true
          style: simple
          schema:
            allOf:
              - $ref: '#/components/schemas/entitlementKey'
              - description: The entitlement to query.
                example: reports
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                type: string
                example: 'true'
              example: 'true'
      deprecated: false
  /test/maven/{groupId}/{artifactId}/{version}:
    get:
      tags:
        - Test
      summary: Test for issues in a public package by group id, artifact id and version
      description: >-
        Test for issues in Maven files.You can test `maven` packages for issues according to their [coordinates](https://maven.apache.org/pom.html#Maven_Coordinates): group ID, artifact ID and version. The repository hosting the package may also be customized (see the `repository` query parameter).


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testforissuesinapublicpackagebygroupid,artifactidandversion
      parameters:
        - name: groupId
          in: path
          description: The package's group ID.
          required: true
          style: simple
          schema:
            type: string
            example: org.apache.flex.blazeds
        - name: artifactId
          in: path
          description: The package's artifact ID.
          required: true
          style: simple
          schema:
            type: string
            example: blazeds
        - name: version
          in: path
          description: The package version to test.
          required: true
          style: simple
          schema:
            type: string
            example: 4.7.2
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
        - name: repository
          in: query
          description: The Maven repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
          style: form
          explode: true
          schema:
            type: string
            example: https://repo1.maven.org/maven2
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Testforissuesinapublicpackagebygroupidartifactidandversionresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
                            url: https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
                            title: Arbitrary Code Execution
                            type: vuln
                            description: >
                              ## Overview


                              [org.apache.flex.blazeds:blazeds](https://github.com/apache/flex-blazeds) is an application development framework for easily building Flash-based applications for mobile devices, web browsers, and desktops.



                              Affected versions of this package are vulnerable to Arbitrary Code Execution.

                              The AMF deserialization implementation of Flex BlazeDS is vulnerable to Deserialization of Untrusted Data. By sending a specially crafted AMF message, it is possible to make the server establish a connection to an endpoint specified in the message and request an RMI remote object from that endpoint. This can result in the execution of arbitrary code on the server via Java deserialization.



                              Starting with BlazeDS version `4.7.3`, Deserialization of XML is disabled completely per default, while the `ClassDeserializationValidator` allows deserialization of whitelisted classes only. BlazeDS internally comes with the following whitelist:

                              ```

                              flex.messaging.io.amf.ASObject

                              flex.messaging.io.amf.SerializedObject

                              flex.messaging.io.ArrayCollection

                              flex.messaging.io.ArrayList

                              flex.messaging.messages.AcknowledgeMessage

                              flex.messaging.messages.AcknowledgeMessageExt

                              flex.messaging.messages.AsyncMessage

                              flex.messaging.messages.AsyncMessageExt

                              flex.messaging.messages.CommandMessage

                              flex.messaging.messages.CommandMessageExt

                              flex.messaging.messages.ErrorMessage

                              flex.messaging.messages.HTTPMessage

                              flex.messaging.messages.RemotingMessage

                              flex.messaging.messages.SOAPMessage

                              java.lang.Boolean

                              java.lang.Byte

                              java.lang.Character

                              java.lang.Double

                              java.lang.Float

                              java.lang.Integer

                              java.lang.Long

                              java.lang.Object

                              java.lang.Short

                              java.lang.String

                              java.util.ArrayList

                              java.util.Date

                              java.util.HashMap

                              org.w3c.dom.Document

                              ```


                              ## Remediation


                              Upgrade `org.apache.flex.blazeds:blazeds` to version 4.7.3 or higher.



                              ## References


                              - [CVE-2017-3066](https://nvd.nist.gov/vuln/detail/CVE-2017-5641)


                              - [Github Commit](https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1)


                              - [Github Release Notes](https://github.com/apache/flex-blazeds/blob/master/RELEASE_NOTES)


                              - [Securitytracker Issue](http://www.securitytracker.com/id/1038364)
                            functions: []
                            from:
                              - org.apache.flex.blazeds:blazeds@4.7.2
                            package: org.apache.flex.blazeds:blazeds
                            version: 4.7.2
                            severity: critical
                            exploitMaturity: no-known-exploit
                            language: java
                            packageManager: maven
                            semver:
                              vulnerable:
                                - '[,4.7.3)'
                            publicationTime: 2017-08-09T14:17:08Z
                            disclosureTime: 2017-04-25T21:00:00Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2017-5641
                              CWE:
                                - CWE-502
                            credit:
                              - Markus Wulftange
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 9.8
                            patches: []
                            upgradePath:
                              - org.apache.flex.blazeds:blazeds@4.7.3
                        licenses: []
                      dependencyCount: 1
                      org:
                        name: atokeneduser
                        id: 689ce7f9-7943-4a71-b704-2ba575f01089
                      licensesPolicy: null
                      packageManager: maven
      deprecated: false
  /test/maven:
    post:
      tags:
        - Test
      summary: Test maven file
      description: >-
        Test for issues in Maven files.You can test your Maven packages for issues according to their manifest file using this action. It takes a JSON object containing a the "target" `pom.xml`.


        Additional manifest files, if they are needed, like parent `pom.xml` files, child poms, etc., according the the definitions in the target `pom.xml` file, should be supplied in the `additional` body parameter.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testmavenfile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
        - name: repository
          in: query
          description: The Maven repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
          style: form
          explode: true
          schema:
            type: string
            example: https://repo1.maven.org/maven2
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Mavenrequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <modelVersion>4.0.0</modelVersion> <parent> <artifactId>io.snyk.example</artifactId> <groupId>parent</groupId> <version>1.0-SNAPSHOT</version> </parent> <artifactId>my-project</artifactId> <dependencies> <dependency> <groupId>axis</groupId> <artifactId>axis</artifactId> <version>1.4</version> </dependency> </dependencies> </project>\n
                      additional:
                        - contents: <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <modelVersion>4.0.0</modelVersion> <artifactId>io.snyk.example</artifactId> <groupId>parent</groupId> <version>1.0-SNAPSHOT</version> <dependencies> <dependency> <groupId>org.apache.zookeeper</groupId> <artifactId>zookeeper</artifactId> <version>3.5</version> </dependency> <dependency> <groupId>org.aspectj</groupId> <artifactId>aspectjweaver</artifactId> <version>1.8.2</version> </dependency> </dependencies> </project>\n
            example:
              encoding: plain
              files:
                target:
                  contents: <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <modelVersion>4.0.0</modelVersion> <parent> <artifactId>io.snyk.example</artifactId> <groupId>parent</groupId> <version>1.0-SNAPSHOT</version> </parent> <artifactId>my-project</artifactId> <dependencies> <dependency> <groupId>axis</groupId> <artifactId>axis</artifactId> <version>1.4</version> </dependency> </dependencies> </project>\n
                additional:
                  - contents: <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <modelVersion>4.0.0</modelVersion> <artifactId>io.snyk.example</artifactId> <groupId>parent</groupId> <version>1.0-SNAPSHOT</version> <dependencies> <dependency> <groupId>org.apache.zookeeper</groupId> <artifactId>zookeeper</artifactId> <version>3.5</version> </dependency> <dependency> <groupId>org.aspectj</groupId> <artifactId>aspectjweaver</artifactId> <version>1.8.2</version> </dependency> </dependencies> </project>\n
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Testmavenfileresponse'
      deprecated: false
  /test/npm/{packageName}/{version}:
    get:
      tags:
        - Test
      summary: Test for issues in a public package by name and version
      description: >-
        Test for issues in npm files.You can test `npm` packages for issues according to their name and version.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testforissuesinapublicpackagebynameandversion
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
        - name: packageName
          in: path
          description: The package name. For scoped packages, **must** be url-encoded, so to test "@angular/core" version 4.3.2, one should `GET /test/npm/%40angular%2Fcore/4.3.2`.
          required: true
          style: simple
          schema:
            type: string
            example: ms
        - name: version
          in: path
          description: The Package version to test.
          required: true
          style: simple
          schema:
            type: string
            example: 0.7.0
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Testforissuesinapublicpackagebynameandversionresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: npm:ms:20151024
                            url: https://snyk.io/vuln/npm:ms:20151024
                            title: Regular Expression Denial of Service (ReDoS)
                            type: vuln
                            description: >
                              ## Overview


                              [ms](https://www.npmjs.com/package/ms) is a tiny millisecond conversion utility.



                              Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS)

                              attack when converting a time period string (i.e. `"2 days"`, `"1h"`) into a milliseconds integer. A malicious user could pass extremely long strings to `ms()`, causing the server to take a long time to process, subsequently blocking the event loop for that extended period.


                              ## Details

                              Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.



                              The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.



                              Let’s take the following regular expression as an example:

                              ```js

                              regex = /A(B|C+)+D/

                              ```



                              This regular expression accomplishes the following:

                              - `A` The string must start with the letter 'A'

                              - `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.

                              - `D` Finally, we ensure this section of the string ends with a 'D'



                              The expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`



                              It most cases, it doesn't take very long for a regex engine to find a match:



                              ```bash

                              $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'

                              0.04s user 0.01s system 95% cpu 0.052 total



                              $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'

                              1.79s user 0.02s system 99% cpu 1.812 total

                              ```



                              The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.



                              Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.



                              Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

                              1. CCC

                              2. CC+C

                              3. C+CC

                              4. C+C+C.



                              The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.



                              From there, the number of steps the engine must use to validate a string just continues to grow.



                              | String | Number of C's | Number of steps |

                              | -------|-------------:| -----:|

                              | ACCCX | 3 | 38

                              | ACCCCX | 4 | 71

                              | ACCCCCX | 5 | 136

                              | ACCCCCCCCCCCCCCX | 14 | 65,553





                              By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.


                              ## Remediation


                              Upgrade `ms` to version 0.7.1 or higher.



                              ## References


                              - [OSS Security advisory](https://www.openwall.com/lists/oss-security/2016/04/20/11)


                              - [OWASP - ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)


                              - [Security Focus](https://www.securityfocus.com/bid/96389)
                            functions:
                              - functionId:
                                  filePath: ms.js
                                  functionName: parse
                                version:
                                  - '>0.1.0 <=0.3.0'
                              - functionId:
                                  filePath: index.js
                                  functionName: parse
                                version:
                                  - '>0.3.0 <0.7.1'
                            from:
                              - ms@0.7.0
                            package: ms
                            version: 0.7.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: js
                            packageManager: npm
                            semver:
                              vulnerable:
                                - <0.7.1
                            publicationTime: 2015-11-06T02:09:36Z
                            disclosureTime: 2015-10-24T20:39:59Z
                            isUpgradable: true
                            isPatchable: true
                            isPinnable: false
                            identifiers:
                              ALTERNATIVE:
                                - SNYK-JS-MS-10064
                              CVE:
                                - CVE-2015-8315
                              CWE:
                                - CWE-400
                              NSP:
                                - 46
                            credit:
                              - Adam Baldwin
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                            cvssScore: 5.3
                            patches:
                              - comments: []
                                id: patch:npm:ms:20151024:5
                                modificationTime: 2019-12-03T11:40:45.777474Z
                                urls:
                                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_5_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk5.patch
                                version: =0.1.0
                              - comments: []
                                id: patch:npm:ms:20151024:4
                                modificationTime: 2019-12-03T11:40:45.776329Z
                                urls:
                                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_4_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk4.patch
                                version: =0.2.0
                              - comments: []
                                id: patch:npm:ms:20151024:3
                                modificationTime: 2019-12-03T11:40:45.775292Z
                                urls:
                                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_3_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk3.patch
                                version: =0.3.0
                              - comments: []
                                id: patch:npm:ms:20151024:2
                                modificationTime: 2019-12-03T11:40:45.774221Z
                                urls:
                                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_2_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk2.patch
                                version: <0.6.0 >0.3.0
                              - comments: []
                                id: patch:npm:ms:20151024:1
                                modificationTime: 2019-12-03T11:40:45.773094Z
                                urls:
                                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_1_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk.patch
                                version: <0.7.0 >=0.6.0
                              - comments: []
                                id: patch:npm:ms:20151024:0
                                modificationTime: 2019-12-03T11:40:45.772009Z
                                urls:
                                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_0_0_48701f029417faf65e6f5e0b61a3cebe5436b07b.patch
                                version: =0.7.0
                            upgradePath:
                              - ms@0.7.1
                        licenses: []
                      dependencyCount: 1
                      org:
                        name: atokeneduser
                        id: 4a18d42f-0706-4ad0-b127-24078731fbed
                      licensesPolicy: null
                      packageManager: npm
      deprecated: false
  /test/npm:
    post:
      tags:
        - Test
      summary: Test package.json & package-lock.json File
      description: >-
        Test for issues in npm files.You can test your npm packages for issues according to their manifest file & optional lockfile using this action. It takes a JSON object containing a "target" `package.json` and optionally a `package-lock.json`.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testpackage.json&package-lock.jsonFile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/npmrequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: eyAibmFtZSI6ICJzaGFsbG93LWdvb2YiLCAidmVyc2lvbiI6ICIwLjAuMSIsICJkZXNjcmlwdGlvbiI6ICJBIHZ1bG5lcmFibGUgZGVtbyBhcHBsaWNhdGlvbiIsICJob21lcGFnZSI6ICJodHRwczovL3NueWsuaW8vIiwgInJlcG9zaXRvcnkiOiB7ICJ0eXBlIjogImdpdCIsICJ1cmwiOiAiaHR0cHM6Ly9naXRodWIuY29tL1NueWsvc2hhbGxvdy1nb29mIiB9LCAiZGVwZW5kZW5jaWVzIjogeyAibm9kZS11dWlkIjogIjEuNC4wIiwgInFzIjogIjAuMC42IiB9IH0K
                      additional:
                        - contents: eyAibmFtZSI6ICJzaGFsbG93LWdvb2YiLCAidmVyc2lvbiI6ICIwLjAuMSIsICJsb2NrZmlsZVZlcnNpb24iOiAxLCAicmVxdWlyZXMiOiB0cnVlLCAiZGVwZW5kZW5jaWVzIjogeyAibm9kZS11dWlkIjogeyAidmVyc2lvbiI6ICIxLjQuMCIsICJyZXNvbHZlZCI6ICJodHRwczovL3JlZ2lzdHJ5Lm5wbWpzLm9yZy9ub2RlLXV1aWQvLS9ub2RlLXV1aWQtMS40LjAudGd6IiwgImludGVncml0eSI6ICJzaGExLUIvbXlNM1Z5LzJKMXgzWGgxSVVUODZSZGVtVT0iIH0sICJxcyI6IHsgInZlcnNpb24iOiAiMC4wLjYiLCAicmVzb2x2ZWQiOiAiaHR0cHM6Ly9yZWdpc3RyeS5ucG1qcy5vcmcvcXMvLS9xcy0wLjAuNi50Z3oiLCAiaW50ZWdyaXR5IjogInNoYTEtU0JaWnQrVy9hbDZvbUFFTjVhN1RYclJwNFNRPSIgfSB9IH0K
            example:
              encoding: plain
              files:
                target:
                  contents: eyAibmFtZSI6ICJzaGFsbG93LWdvb2YiLCAidmVyc2lvbiI6ICIwLjAuMSIsICJkZXNjcmlwdGlvbiI6ICJBIHZ1bG5lcmFibGUgZGVtbyBhcHBsaWNhdGlvbiIsICJob21lcGFnZSI6ICJodHRwczovL3NueWsuaW8vIiwgInJlcG9zaXRvcnkiOiB7ICJ0eXBlIjogImdpdCIsICJ1cmwiOiAiaHR0cHM6Ly9naXRodWIuY29tL1NueWsvc2hhbGxvdy1nb29mIiB9LCAiZGVwZW5kZW5jaWVzIjogeyAibm9kZS11dWlkIjogIjEuNC4wIiwgInFzIjogIjAuMC42IiB9IH0K
                additional:
                  - contents: eyAibmFtZSI6ICJzaGFsbG93LWdvb2YiLCAidmVyc2lvbiI6ICIwLjAuMSIsICJsb2NrZmlsZVZlcnNpb24iOiAxLCAicmVxdWlyZXMiOiB0cnVlLCAiZGVwZW5kZW5jaWVzIjogeyAibm9kZS11dWlkIjogeyAidmVyc2lvbiI6ICIxLjQuMCIsICJyZXNvbHZlZCI6ICJodHRwczovL3JlZ2lzdHJ5Lm5wbWpzLm9yZy9ub2RlLXV1aWQvLS9ub2RlLXV1aWQtMS40LjAudGd6IiwgImludGVncml0eSI6ICJzaGExLUIvbXlNM1Z5LzJKMXgzWGgxSVVUODZSZGVtVT0iIH0sICJxcyI6IHsgInZlcnNpb24iOiAiMC4wLjYiLCAicmVzb2x2ZWQiOiAiaHR0cHM6Ly9yZWdpc3RyeS5ucG1qcy5vcmcvcXMvLS9xcy0wLjAuNi50Z3oiLCAiaW50ZWdyaXR5IjogInNoYTEtU0JaWnQrVy9hbDZvbUFFTjVhN1RYclJwNFNRPSIgfSB9IH0K
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Testpackage.jsonpackage-lock.jsonFileresponse'
      deprecated: false
  /test/golangdep:
    post:
      tags:
        - Test
      summary: Test Gopkg.toml & Gopkg.lock File
      description: >-
        Test for issues in Go dep files.You can test your Go dep packages for issues according to their manifest file & lockfile using this action. It takes a JSON object containing a "target" `Gopkg.toml` and a `Gopkg.lock`.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: TestGopkg.toml&Gopkg.lockFile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/golangdeprequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: '"# Gopkg.toml example\r\n#\r\n# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html\r\n# for detailed Gopkg.toml documentation.\r\n#\r\n# required = [\"github.com/user/thing/cmd/thing\"]\r\n# ignored = [\"github.com/user/project/pkgX\", \"bitbucket.org/user/project/pkgA/pkgY\"]\r\n#\r\n# [[constraint]]\r\n#   name = \"github.com/user/project\"\r\n#   version = \"1.0.0\"\r\n#\r\n# [[constraint]]\r\n#   name = \"github.com/user/project2\"\r\n#   branch = \"dev\"\r\n#   source = \"github.com/myfork/project2\"\r\n#\r\n# [[override]]\r\n#   name = \"github.com/x/y\"\r\n#   version = \"2.4.0\"\r\n#\r\n# [prune]\r\n#   non-go = false\r\n#   go-tests = true\r\n#   unused-packages = true\r\n\r\n\r\n[[constraint]]\r\n  branch = \"master\"\r\n  name = \"github.com/asaskevich/EventBus\"\r\n\r\n[[constraint]]\r\n  branch = \"master\"\r\n  name = \"github.com/cloudevents/sdk-go\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/gin-gonic/gin\"\r\n  version = \"1.3.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/golang/protobuf\"\r\n  version = \"1.2.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/goph/emperror\"\r\n  version = \"0.14.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/goph/logur\"\r\n  version = \"0.5.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/patrickmn/go-cache\"\r\n  version = \"2.1.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/pkg/errors\"\r\n  version = \"0.8.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/satori/go.uuid\"\r\n  version = \"1.2.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/sirupsen/logrus\"\r\n  version = \"1.2.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/spf13/cast\"\r\n  version = \"1.3.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/spf13/pflag\"\r\n  version = \"1.0.3\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/spf13/viper\"\r\n  version = \"1.3.1\"\r\n\r\n[[constraint]]\r\n  branch = \"master\"\r\n  name = \"golang.org/x/net\"\r\n\r\n[[constraint]]\r\n  name = \"google.golang.org/grpc\"\r\n  version = \"1.17.0\"\r\n\r\n[[constraint]]\r\n  name = \"gopkg.in/go-playground/validator.v8\"\r\n  version = \"8.18.2\"\r\n\r\n[[constraint]]\r\n  name = \"gopkg.in/yaml.v2\"\r\n  version = \"2.2.2\"\r\n\r\n[prune]\r\n  go-tests = true\r\n  unused-packages = true"'
                      additional:
                        - contents: "\"# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.\\r\\n\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:e2a1ff1174d564ed4b75a62757f4a9081ed3b8c99ed17e47eb252b048b4ff018\\\"\\r\\n  name = \\\"github.com/asaskevich/EventBus\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"d46933a94f05c6657d7b923fcf5ac563ee37ec79\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:b95c3763b72359370262246870366418c1d17446195e3c73921135c2537b9655\\\"\\r\\n  name = \\\"github.com/cloudevents/sdk-go\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"v02\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"3a3d34a7231e937edfa20964dc25c29081c3ebea\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:abeb38ade3f32a92943e5be54f55ed6d6e3b6602761d74b4aab4c9dd45c18abd\\\"\\r\\n  name = \\\"github.com/fsnotify/fsnotify\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c2828203cd70a50dcccfb2761f8b1f8ceef9a8e9\\\"\\r\\n  version = \\\"v1.4.7\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:36fe9527deed01d2a317617e59304eb2c4ce9f8a24115bcc5c2e37b3aee5bae4\\\"\\r\\n  name = \\\"github.com/gin-contrib/sse\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"22d885f9ecc78bf4ee5d72b937e4bbcdc58e8cae\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:d5083934eb25e45d17f72ffa86cae3814f4a9d6c073c4f16b64147169b245606\\\"\\r\\n  name = \\\"github.com/gin-gonic/gin\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"binding\\\",\\r\\n    \\\"json\\\",\\r\\n    \\\"render\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"b869fe1415e4b9eb52f247441830d502aece2d4d\\\"\\r\\n  version = \\\"v1.3.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:4c0989ca0bcd10799064318923b9bc2db6b4d6338dd75f3f2d86c3511aaaf5cf\\\"\\r\\n  name = \\\"github.com/golang/protobuf\\\"\\r\\n  packages = [\\r\\n    \\\"proto\\\",\\r\\n    \\\"ptypes\\\",\\r\\n    \\\"ptypes/any\\\",\\r\\n    \\\"ptypes/duration\\\",\\r\\n    \\\"ptypes/timestamp\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"aa810b61a9c79d51363740d207bb46cf8e620ed5\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:4e0e5d786c35c402574cda1906195d9fbd76a35d2c921eb10199741faf4f0256\\\"\\r\\n  name = \\\"github.com/goph/emperror\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"b1b4a9b847ebc56299eb729faa942b89e9d8a562\\\"\\r\\n  version = \\\"v0.14.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:dd95856542089c3e0487299d6ac92f5f2941e97625b5a5754a483c7730e8dc89\\\"\\r\\n  name = \\\"github.com/goph/logur\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"111a952ccfacab0a90b9e4496da21d9f15187769\\\"\\r\\n  version = \\\"v0.5.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c0d19ab64b32ce9fe5cf4ddceba78d5bc9807f0016db6b1183599da3dcc24d10\\\"\\r\\n  name = \\\"github.com/hashicorp/hcl\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"hcl/ast\\\",\\r\\n    \\\"hcl/parser\\\",\\r\\n    \\\"hcl/printer\\\",\\r\\n    \\\"hcl/scanner\\\",\\r\\n    \\\"hcl/strconv\\\",\\r\\n    \\\"hcl/token\\\",\\r\\n    \\\"json/parser\\\",\\r\\n    \\\"json/scanner\\\",\\r\\n    \\\"json/token\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"8cb6e5b959231cc1119e43259c4a608f9c51a241\\\"\\r\\n  version = \\\"v1.0.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:be97e109f627d3ba8edfef50c9c74f0d0c17cbe3a2e924a8985e4804a894f282\\\"\\r\\n  name = \\\"github.com/json-iterator/go\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"36b14963da70d11297d313183d7e6388c8510e1e\\\"\\r\\n  version = \\\"1.0.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:0a69a1c0db3591fcefb47f115b224592c8dfa4368b7ba9fae509d5e16cdc95c8\\\"\\r\\n  name = \\\"github.com/konsorten/go-windows-terminal-sequences\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"5c8c8bd35d3832f5d134ae1e1e375b69a4d25242\\\"\\r\\n  version = \\\"v1.0.1\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c568d7727aa262c32bdf8a3f7db83614f7af0ed661474b24588de635c20024c7\\\"\\r\\n  name = \\\"github.com/magiconair/properties\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c2353362d570a7bfa228149c62842019201cfb71\\\"\\r\\n  version = \\\"v1.8.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:fa610f9fe6a93f4a75e64c83673dfff9bf1a34bbb21e6102021b6bc7850834a3\\\"\\r\\n  name = \\\"github.com/mattn/go-isatty\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"57fdcb988a5c543893cc61bce354a6e24ab70022\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:53bc4cd4914cd7cd52139990d5170d6dc99067ae31c56530621b18b35fc30318\\\"\\r\\n  name = \\\"github.com/mitchellh/mapstructure\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"3536a929edddb9a5b34bd6861dc4a9647cb459fe\\\"\\r\\n  version = \\\"v1.1.2\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:808cdddf087fb64baeae67b8dfaee2069034d9704923a3cb8bd96a995421a625\\\"\\r\\n  name = \\\"github.com/patrickmn/go-cache\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"a3647f8e31d79543b2d0f0ae2fe5c379d72cedc0\\\"\\r\\n  version = \\\"v2.1.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:95741de3af260a92cc5c7f3f3061e85273f5a81b5db20d4bd68da74bd521675e\\\"\\r\\n  name = \\\"github.com/pelletier/go-toml\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c01d1270ff3e442a8a57cddc1c92dc1138598194\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:40e195917a951a8bf867cd05de2a46aaf1806c50cf92eebf4c16f78cd196f747\\\"\\r\\n  name = \\\"github.com/pkg/errors\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"645ef00459ed84a119197bfb8d8205042c6df63d\\\"\\r\\n  version = \\\"v0.8.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:274f67cb6fed9588ea2521ecdac05a6d62a8c51c074c1fccc6a49a40ba80e925\\\"\\r\\n  name = \\\"github.com/satori/go.uuid\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"f58768cc1a7a7e77a3bd49e98cdd21419399b6a3\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:69b1cc331fca23d702bd72f860c6a647afd0aa9fcbc1d0659b1365e26546dd70\\\"\\r\\n  name = \\\"github.com/sirupsen/logrus\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"bcd833dfe83d3cebad139e4a29ed79cb2318bf95\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:d707dbc1330c0ed177d4642d6ae102d5e2c847ebd0eb84562d0dc4f024531cfc\\\"\\r\\n  name = \\\"github.com/spf13/afero\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"mem\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"a5d6946387efe7d64d09dcba68cdd523dc1273a3\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:08d65904057412fc0270fc4812a1c90c594186819243160dc779a402d4b6d0bc\\\"\\r\\n  name = \\\"github.com/spf13/cast\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"8c9545af88b134710ab1cd196795e7f2388358d7\\\"\\r\\n  version = \\\"v1.3.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:68ea4e23713989dc20b1bded5d9da2c5f9be14ff9885beef481848edd18c26cb\\\"\\r\\n  name = \\\"github.com/spf13/jwalterweatherman\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"4a4406e478ca629068e7768fc33f3f044173c0a6\\\"\\r\\n  version = \\\"v1.0.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c1b1102241e7f645bc8e0c22ae352e8f0dc6484b6cb4d132fa9f24174e0119e2\\\"\\r\\n  name = \\\"github.com/spf13/pflag\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"298182f68c66c05229eb03ac171abe6e309ee79a\\\"\\r\\n  version = \\\"v1.0.3\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:de37e343c64582d7026bf8ab6ac5b22a72eac54f3a57020db31524affed9f423\\\"\\r\\n  name = \\\"github.com/spf13/viper\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"6d33b5a963d922d182c91e8a1c88d81fd150cfd4\\\"\\r\\n  version = \\\"v1.3.1\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c268acaa4a4d94a467980e5e91452eb61c460145765293dc0aed48e5e9919cc6\\\"\\r\\n  name = \\\"github.com/ugorji/go\\\"\\r\\n  packages = [\\\"codec\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c88ee250d0221a57af388746f5cf03768c21d6e2\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:38f553aff0273ad6f367cb0a0f8b6eecbaef8dc6cb8b50e57b6a81c1d5b1e332\\\"\\r\\n  name = \\\"golang.org/x/crypto\\\"\\r\\n  packages = [\\\"ssh/terminal\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"505ab145d0a99da450461ae2c1a9f6cd10d1f447\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:89a0cb976397aa9157a45bb2b896d0bcd07ee095ac975e0f03c53250c402265e\\\"\\r\\n  name = \\\"golang.org/x/net\\\"\\r\\n  packages = [\\r\\n    \\\"context\\\",\\r\\n    \\\"http/httpguts\\\",\\r\\n    \\\"http2\\\",\\r\\n    \\\"http2/hpack\\\",\\r\\n    \\\"idna\\\",\\r\\n    \\\"internal/timeseries\\\",\\r\\n    \\\"trace\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"e147a9138326bc0e9d4e179541ffd8af41cff8a9\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:ba8cbf57cfd92d5f8592b4aca1a35d92c162363d32aeabd5b12555f8896635e7\\\"\\r\\n  name = \\\"golang.org/x/sys\\\"\\r\\n  packages = [\\r\\n    \\\"unix\\\",\\r\\n    \\\"windows\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"4d1cda033e0619309c606fc686de3adcf599539e\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:a2ab62866c75542dd18d2b069fec854577a20211d7c0ea6ae746072a1dccdd18\\\"\\r\\n  name = \\\"golang.org/x/text\\\"\\r\\n  packages = [\\r\\n    \\\"collate\\\",\\r\\n    \\\"collate/build\\\",\\r\\n    \\\"internal/colltab\\\",\\r\\n    \\\"internal/gen\\\",\\r\\n    \\\"internal/tag\\\",\\r\\n    \\\"internal/triegen\\\",\\r\\n    \\\"internal/ucd\\\",\\r\\n    \\\"language\\\",\\r\\n    \\\"secure/bidirule\\\",\\r\\n    \\\"transform\\\",\\r\\n    \\\"unicode/bidi\\\",\\r\\n    \\\"unicode/cldr\\\",\\r\\n    \\\"unicode/norm\\\",\\r\\n    \\\"unicode/rangetable\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"f21a4dfb5e38f5895301dc265a8def02365cc3d0\\\"\\r\\n  version = \\\"v0.3.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:077c1c599507b3b3e9156d17d36e1e61928ee9b53a5b420f10f28ebd4a0b275c\\\"\\r\\n  name = \\\"google.golang.org/genproto\\\"\\r\\n  packages = [\\\"googleapis/rpc/status\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"bd91e49a0898e27abb88c339b432fa53d7497ac0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:9edd250a3c46675d0679d87540b30c9ed253b19bd1fd1af08f4f5fb3c79fc487\\\"\\r\\n  name = \\\"google.golang.org/grpc\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"balancer\\\",\\r\\n    \\\"balancer/base\\\",\\r\\n    \\\"balancer/roundrobin\\\",\\r\\n    \\\"binarylog/grpc_binarylog_v1\\\",\\r\\n    \\\"codes\\\",\\r\\n    \\\"connectivity\\\",\\r\\n    \\\"credentials\\\",\\r\\n    \\\"credentials/internal\\\",\\r\\n    \\\"encoding\\\",\\r\\n    \\\"encoding/proto\\\",\\r\\n    \\\"grpclog\\\",\\r\\n    \\\"internal\\\",\\r\\n    \\\"internal/backoff\\\",\\r\\n    \\\"internal/binarylog\\\",\\r\\n    \\\"internal/channelz\\\",\\r\\n    \\\"internal/envconfig\\\",\\r\\n    \\\"internal/grpcrand\\\",\\r\\n    \\\"internal/grpcsync\\\",\\r\\n    \\\"internal/syscall\\\",\\r\\n    \\\"internal/transport\\\",\\r\\n    \\\"keepalive\\\",\\r\\n    \\\"metadata\\\",\\r\\n    \\\"naming\\\",\\r\\n    \\\"peer\\\",\\r\\n    \\\"resolver\\\",\\r\\n    \\\"resolver/dns\\\",\\r\\n    \\\"resolver/passthrough\\\",\\r\\n    \\\"stats\\\",\\r\\n    \\\"status\\\",\\r\\n    \\\"tap\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"df014850f6dee74ba2fc94874043a9f3f75fbfd8\\\"\\r\\n  version = \\\"v1.17.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:cbc72c4c4886a918d6ab4b95e347ffe259846260f99ebdd8a198c2331cf2b2e9\\\"\\r\\n  name = \\\"gopkg.in/go-playground/validator.v8\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"5f1438d3fca68893a817e4a66806cea46a9e4ebf\\\"\\r\\n  version = \\\"v8.18.2\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:4d2e5a73dc1500038e504a8d78b986630e3626dc027bc030ba5c75da257cdb96\\\"\\r\\n  name = \\\"gopkg.in/yaml.v2\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"51d6538a90f86fe93ac480b35f37b2be17fef232\\\"\\r\\n  version = \\\"v2.2.2\\\"\\r\\n\\r\\n[solve-meta]\\r\\n  analyzer-name = \\\"dep\\\"\\r\\n  analyzer-version = 1\\r\\n  input-imports = [\\r\\n    \\\"github.com/asaskevich/EventBus\\\",\\r\\n    \\\"github.com/cloudevents/sdk-go/v02\\\",\\r\\n    \\\"github.com/gin-gonic/gin\\\",\\r\\n    \\\"github.com/golang/protobuf/proto\\\",\\r\\n    \\\"github.com/goph/emperror\\\",\\r\\n    \\\"github.com/goph/logur\\\",\\r\\n    \\\"github.com/karlseguin/ccache\\\",\\r\\n    \\\"github.com/patrickmn/go-cache\\\",\\r\\n    \\\"github.com/pkg/errors\\\",\\r\\n    \\\"github.com/satori/go.uuid\\\",\\r\\n    \\\"github.com/sirupsen/logrus\\\",\\r\\n    \\\"github.com/spf13/cast\\\",\\r\\n    \\\"github.com/spf13/pflag\\\",\\r\\n    \\\"github.com/spf13/viper\\\",\\r\\n    \\\"golang.org/x/net/context\\\",\\r\\n    \\\"google.golang.org/grpc\\\",\\r\\n    \\\"gopkg.in/go-playground/validator.v8\\\",\\r\\n    \\\"gopkg.in/yaml.v2\\\",\\r\\n  ]\\r\\n  solver-name = \\\"gps-cdcl\\\"\\r\\n  solver-version = 1\""
            example:
              encoding: plain
              files:
                target:
                  contents: '"# Gopkg.toml example\r\n#\r\n# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html\r\n# for detailed Gopkg.toml documentation.\r\n#\r\n# required = [\"github.com/user/thing/cmd/thing\"]\r\n# ignored = [\"github.com/user/project/pkgX\", \"bitbucket.org/user/project/pkgA/pkgY\"]\r\n#\r\n# [[constraint]]\r\n#   name = \"github.com/user/project\"\r\n#   version = \"1.0.0\"\r\n#\r\n# [[constraint]]\r\n#   name = \"github.com/user/project2\"\r\n#   branch = \"dev\"\r\n#   source = \"github.com/myfork/project2\"\r\n#\r\n# [[override]]\r\n#   name = \"github.com/x/y\"\r\n#   version = \"2.4.0\"\r\n#\r\n# [prune]\r\n#   non-go = false\r\n#   go-tests = true\r\n#   unused-packages = true\r\n\r\n\r\n[[constraint]]\r\n  branch = \"master\"\r\n  name = \"github.com/asaskevich/EventBus\"\r\n\r\n[[constraint]]\r\n  branch = \"master\"\r\n  name = \"github.com/cloudevents/sdk-go\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/gin-gonic/gin\"\r\n  version = \"1.3.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/golang/protobuf\"\r\n  version = \"1.2.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/goph/emperror\"\r\n  version = \"0.14.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/goph/logur\"\r\n  version = \"0.5.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/patrickmn/go-cache\"\r\n  version = \"2.1.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/pkg/errors\"\r\n  version = \"0.8.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/satori/go.uuid\"\r\n  version = \"1.2.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/sirupsen/logrus\"\r\n  version = \"1.2.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/spf13/cast\"\r\n  version = \"1.3.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/spf13/pflag\"\r\n  version = \"1.0.3\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/spf13/viper\"\r\n  version = \"1.3.1\"\r\n\r\n[[constraint]]\r\n  branch = \"master\"\r\n  name = \"golang.org/x/net\"\r\n\r\n[[constraint]]\r\n  name = \"google.golang.org/grpc\"\r\n  version = \"1.17.0\"\r\n\r\n[[constraint]]\r\n  name = \"gopkg.in/go-playground/validator.v8\"\r\n  version = \"8.18.2\"\r\n\r\n[[constraint]]\r\n  name = \"gopkg.in/yaml.v2\"\r\n  version = \"2.2.2\"\r\n\r\n[prune]\r\n  go-tests = true\r\n  unused-packages = true"'
                additional:
                  - contents: "\"# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.\\r\\n\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:e2a1ff1174d564ed4b75a62757f4a9081ed3b8c99ed17e47eb252b048b4ff018\\\"\\r\\n  name = \\\"github.com/asaskevich/EventBus\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"d46933a94f05c6657d7b923fcf5ac563ee37ec79\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:b95c3763b72359370262246870366418c1d17446195e3c73921135c2537b9655\\\"\\r\\n  name = \\\"github.com/cloudevents/sdk-go\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"v02\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"3a3d34a7231e937edfa20964dc25c29081c3ebea\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:abeb38ade3f32a92943e5be54f55ed6d6e3b6602761d74b4aab4c9dd45c18abd\\\"\\r\\n  name = \\\"github.com/fsnotify/fsnotify\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c2828203cd70a50dcccfb2761f8b1f8ceef9a8e9\\\"\\r\\n  version = \\\"v1.4.7\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:36fe9527deed01d2a317617e59304eb2c4ce9f8a24115bcc5c2e37b3aee5bae4\\\"\\r\\n  name = \\\"github.com/gin-contrib/sse\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"22d885f9ecc78bf4ee5d72b937e4bbcdc58e8cae\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:d5083934eb25e45d17f72ffa86cae3814f4a9d6c073c4f16b64147169b245606\\\"\\r\\n  name = \\\"github.com/gin-gonic/gin\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"binding\\\",\\r\\n    \\\"json\\\",\\r\\n    \\\"render\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"b869fe1415e4b9eb52f247441830d502aece2d4d\\\"\\r\\n  version = \\\"v1.3.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:4c0989ca0bcd10799064318923b9bc2db6b4d6338dd75f3f2d86c3511aaaf5cf\\\"\\r\\n  name = \\\"github.com/golang/protobuf\\\"\\r\\n  packages = [\\r\\n    \\\"proto\\\",\\r\\n    \\\"ptypes\\\",\\r\\n    \\\"ptypes/any\\\",\\r\\n    \\\"ptypes/duration\\\",\\r\\n    \\\"ptypes/timestamp\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"aa810b61a9c79d51363740d207bb46cf8e620ed5\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:4e0e5d786c35c402574cda1906195d9fbd76a35d2c921eb10199741faf4f0256\\\"\\r\\n  name = \\\"github.com/goph/emperror\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"b1b4a9b847ebc56299eb729faa942b89e9d8a562\\\"\\r\\n  version = \\\"v0.14.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:dd95856542089c3e0487299d6ac92f5f2941e97625b5a5754a483c7730e8dc89\\\"\\r\\n  name = \\\"github.com/goph/logur\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"111a952ccfacab0a90b9e4496da21d9f15187769\\\"\\r\\n  version = \\\"v0.5.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c0d19ab64b32ce9fe5cf4ddceba78d5bc9807f0016db6b1183599da3dcc24d10\\\"\\r\\n  name = \\\"github.com/hashicorp/hcl\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"hcl/ast\\\",\\r\\n    \\\"hcl/parser\\\",\\r\\n    \\\"hcl/printer\\\",\\r\\n    \\\"hcl/scanner\\\",\\r\\n    \\\"hcl/strconv\\\",\\r\\n    \\\"hcl/token\\\",\\r\\n    \\\"json/parser\\\",\\r\\n    \\\"json/scanner\\\",\\r\\n    \\\"json/token\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"8cb6e5b959231cc1119e43259c4a608f9c51a241\\\"\\r\\n  version = \\\"v1.0.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:be97e109f627d3ba8edfef50c9c74f0d0c17cbe3a2e924a8985e4804a894f282\\\"\\r\\n  name = \\\"github.com/json-iterator/go\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"36b14963da70d11297d313183d7e6388c8510e1e\\\"\\r\\n  version = \\\"1.0.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:0a69a1c0db3591fcefb47f115b224592c8dfa4368b7ba9fae509d5e16cdc95c8\\\"\\r\\n  name = \\\"github.com/konsorten/go-windows-terminal-sequences\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"5c8c8bd35d3832f5d134ae1e1e375b69a4d25242\\\"\\r\\n  version = \\\"v1.0.1\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c568d7727aa262c32bdf8a3f7db83614f7af0ed661474b24588de635c20024c7\\\"\\r\\n  name = \\\"github.com/magiconair/properties\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c2353362d570a7bfa228149c62842019201cfb71\\\"\\r\\n  version = \\\"v1.8.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:fa610f9fe6a93f4a75e64c83673dfff9bf1a34bbb21e6102021b6bc7850834a3\\\"\\r\\n  name = \\\"github.com/mattn/go-isatty\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"57fdcb988a5c543893cc61bce354a6e24ab70022\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:53bc4cd4914cd7cd52139990d5170d6dc99067ae31c56530621b18b35fc30318\\\"\\r\\n  name = \\\"github.com/mitchellh/mapstructure\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"3536a929edddb9a5b34bd6861dc4a9647cb459fe\\\"\\r\\n  version = \\\"v1.1.2\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:808cdddf087fb64baeae67b8dfaee2069034d9704923a3cb8bd96a995421a625\\\"\\r\\n  name = \\\"github.com/patrickmn/go-cache\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"a3647f8e31d79543b2d0f0ae2fe5c379d72cedc0\\\"\\r\\n  version = \\\"v2.1.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:95741de3af260a92cc5c7f3f3061e85273f5a81b5db20d4bd68da74bd521675e\\\"\\r\\n  name = \\\"github.com/pelletier/go-toml\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c01d1270ff3e442a8a57cddc1c92dc1138598194\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:40e195917a951a8bf867cd05de2a46aaf1806c50cf92eebf4c16f78cd196f747\\\"\\r\\n  name = \\\"github.com/pkg/errors\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"645ef00459ed84a119197bfb8d8205042c6df63d\\\"\\r\\n  version = \\\"v0.8.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:274f67cb6fed9588ea2521ecdac05a6d62a8c51c074c1fccc6a49a40ba80e925\\\"\\r\\n  name = \\\"github.com/satori/go.uuid\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"f58768cc1a7a7e77a3bd49e98cdd21419399b6a3\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:69b1cc331fca23d702bd72f860c6a647afd0aa9fcbc1d0659b1365e26546dd70\\\"\\r\\n  name = \\\"github.com/sirupsen/logrus\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"bcd833dfe83d3cebad139e4a29ed79cb2318bf95\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:d707dbc1330c0ed177d4642d6ae102d5e2c847ebd0eb84562d0dc4f024531cfc\\\"\\r\\n  name = \\\"github.com/spf13/afero\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"mem\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"a5d6946387efe7d64d09dcba68cdd523dc1273a3\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:08d65904057412fc0270fc4812a1c90c594186819243160dc779a402d4b6d0bc\\\"\\r\\n  name = \\\"github.com/spf13/cast\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"8c9545af88b134710ab1cd196795e7f2388358d7\\\"\\r\\n  version = \\\"v1.3.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:68ea4e23713989dc20b1bded5d9da2c5f9be14ff9885beef481848edd18c26cb\\\"\\r\\n  name = \\\"github.com/spf13/jwalterweatherman\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"4a4406e478ca629068e7768fc33f3f044173c0a6\\\"\\r\\n  version = \\\"v1.0.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c1b1102241e7f645bc8e0c22ae352e8f0dc6484b6cb4d132fa9f24174e0119e2\\\"\\r\\n  name = \\\"github.com/spf13/pflag\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"298182f68c66c05229eb03ac171abe6e309ee79a\\\"\\r\\n  version = \\\"v1.0.3\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:de37e343c64582d7026bf8ab6ac5b22a72eac54f3a57020db31524affed9f423\\\"\\r\\n  name = \\\"github.com/spf13/viper\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"6d33b5a963d922d182c91e8a1c88d81fd150cfd4\\\"\\r\\n  version = \\\"v1.3.1\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c268acaa4a4d94a467980e5e91452eb61c460145765293dc0aed48e5e9919cc6\\\"\\r\\n  name = \\\"github.com/ugorji/go\\\"\\r\\n  packages = [\\\"codec\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c88ee250d0221a57af388746f5cf03768c21d6e2\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:38f553aff0273ad6f367cb0a0f8b6eecbaef8dc6cb8b50e57b6a81c1d5b1e332\\\"\\r\\n  name = \\\"golang.org/x/crypto\\\"\\r\\n  packages = [\\\"ssh/terminal\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"505ab145d0a99da450461ae2c1a9f6cd10d1f447\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:89a0cb976397aa9157a45bb2b896d0bcd07ee095ac975e0f03c53250c402265e\\\"\\r\\n  name = \\\"golang.org/x/net\\\"\\r\\n  packages = [\\r\\n    \\\"context\\\",\\r\\n    \\\"http/httpguts\\\",\\r\\n    \\\"http2\\\",\\r\\n    \\\"http2/hpack\\\",\\r\\n    \\\"idna\\\",\\r\\n    \\\"internal/timeseries\\\",\\r\\n    \\\"trace\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"e147a9138326bc0e9d4e179541ffd8af41cff8a9\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:ba8cbf57cfd92d5f8592b4aca1a35d92c162363d32aeabd5b12555f8896635e7\\\"\\r\\n  name = \\\"golang.org/x/sys\\\"\\r\\n  packages = [\\r\\n    \\\"unix\\\",\\r\\n    \\\"windows\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"4d1cda033e0619309c606fc686de3adcf599539e\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:a2ab62866c75542dd18d2b069fec854577a20211d7c0ea6ae746072a1dccdd18\\\"\\r\\n  name = \\\"golang.org/x/text\\\"\\r\\n  packages = [\\r\\n    \\\"collate\\\",\\r\\n    \\\"collate/build\\\",\\r\\n    \\\"internal/colltab\\\",\\r\\n    \\\"internal/gen\\\",\\r\\n    \\\"internal/tag\\\",\\r\\n    \\\"internal/triegen\\\",\\r\\n    \\\"internal/ucd\\\",\\r\\n    \\\"language\\\",\\r\\n    \\\"secure/bidirule\\\",\\r\\n    \\\"transform\\\",\\r\\n    \\\"unicode/bidi\\\",\\r\\n    \\\"unicode/cldr\\\",\\r\\n    \\\"unicode/norm\\\",\\r\\n    \\\"unicode/rangetable\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"f21a4dfb5e38f5895301dc265a8def02365cc3d0\\\"\\r\\n  version = \\\"v0.3.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:077c1c599507b3b3e9156d17d36e1e61928ee9b53a5b420f10f28ebd4a0b275c\\\"\\r\\n  name = \\\"google.golang.org/genproto\\\"\\r\\n  packages = [\\\"googleapis/rpc/status\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"bd91e49a0898e27abb88c339b432fa53d7497ac0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:9edd250a3c46675d0679d87540b30c9ed253b19bd1fd1af08f4f5fb3c79fc487\\\"\\r\\n  name = \\\"google.golang.org/grpc\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"balancer\\\",\\r\\n    \\\"balancer/base\\\",\\r\\n    \\\"balancer/roundrobin\\\",\\r\\n    \\\"binarylog/grpc_binarylog_v1\\\",\\r\\n    \\\"codes\\\",\\r\\n    \\\"connectivity\\\",\\r\\n    \\\"credentials\\\",\\r\\n    \\\"credentials/internal\\\",\\r\\n    \\\"encoding\\\",\\r\\n    \\\"encoding/proto\\\",\\r\\n    \\\"grpclog\\\",\\r\\n    \\\"internal\\\",\\r\\n    \\\"internal/backoff\\\",\\r\\n    \\\"internal/binarylog\\\",\\r\\n    \\\"internal/channelz\\\",\\r\\n    \\\"internal/envconfig\\\",\\r\\n    \\\"internal/grpcrand\\\",\\r\\n    \\\"internal/grpcsync\\\",\\r\\n    \\\"internal/syscall\\\",\\r\\n    \\\"internal/transport\\\",\\r\\n    \\\"keepalive\\\",\\r\\n    \\\"metadata\\\",\\r\\n    \\\"naming\\\",\\r\\n    \\\"peer\\\",\\r\\n    \\\"resolver\\\",\\r\\n    \\\"resolver/dns\\\",\\r\\n    \\\"resolver/passthrough\\\",\\r\\n    \\\"stats\\\",\\r\\n    \\\"status\\\",\\r\\n    \\\"tap\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"df014850f6dee74ba2fc94874043a9f3f75fbfd8\\\"\\r\\n  version = \\\"v1.17.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:cbc72c4c4886a918d6ab4b95e347ffe259846260f99ebdd8a198c2331cf2b2e9\\\"\\r\\n  name = \\\"gopkg.in/go-playground/validator.v8\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"5f1438d3fca68893a817e4a66806cea46a9e4ebf\\\"\\r\\n  version = \\\"v8.18.2\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:4d2e5a73dc1500038e504a8d78b986630e3626dc027bc030ba5c75da257cdb96\\\"\\r\\n  name = \\\"gopkg.in/yaml.v2\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"51d6538a90f86fe93ac480b35f37b2be17fef232\\\"\\r\\n  version = \\\"v2.2.2\\\"\\r\\n\\r\\n[solve-meta]\\r\\n  analyzer-name = \\\"dep\\\"\\r\\n  analyzer-version = 1\\r\\n  input-imports = [\\r\\n    \\\"github.com/asaskevich/EventBus\\\",\\r\\n    \\\"github.com/cloudevents/sdk-go/v02\\\",\\r\\n    \\\"github.com/gin-gonic/gin\\\",\\r\\n    \\\"github.com/golang/protobuf/proto\\\",\\r\\n    \\\"github.com/goph/emperror\\\",\\r\\n    \\\"github.com/goph/logur\\\",\\r\\n    \\\"github.com/karlseguin/ccache\\\",\\r\\n    \\\"github.com/patrickmn/go-cache\\\",\\r\\n    \\\"github.com/pkg/errors\\\",\\r\\n    \\\"github.com/satori/go.uuid\\\",\\r\\n    \\\"github.com/sirupsen/logrus\\\",\\r\\n    \\\"github.com/spf13/cast\\\",\\r\\n    \\\"github.com/spf13/pflag\\\",\\r\\n    \\\"github.com/spf13/viper\\\",\\r\\n    \\\"golang.org/x/net/context\\\",\\r\\n    \\\"google.golang.org/grpc\\\",\\r\\n    \\\"gopkg.in/go-playground/validator.v8\\\",\\r\\n    \\\"gopkg.in/yaml.v2\\\",\\r\\n  ]\\r\\n  solver-name = \\\"gps-cdcl\\\"\\r\\n  solver-version = 1\""
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/TestGopkg.tomlGopkg.lockFileresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
                            url: http://localhost:34612/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
                            title: Insecure Randomness
                            type: vuln
                            description: "## Overview\n[github.com/satori/go.uuid](https://github.com/satori/go.uuid) provides pure Go implementation of Universally Unique Identifier (UUID).\r\n\r\nAffected versions of this package are vulnerable to Insecure Randomness producing predictable `UUID` identifiers due to the limited number of bytes read when using the `g.rand.Read` function.\r\n \r\n## Disclosure Timeline\r\n* Jun 3th, 2018 - The vulnerability introduced by replacing the function `rand.Read()` with the function `g.rand.Read()` (https://github.com/satori/go.uuid/commit/0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c)\r\n* Mar 23th, 2018- An issue was reported.\r\n* Oct 16th, 2018 Issue fixed\r\n\r\n## Remediation\r\nA fix was merged into the master branch but not yet published.\n\n## References\n- [GitHub Commit](https://github.com/satori/go.uuid/commit/d91630c8510268e75203009fe7daf2b8e1d60c45)\n- [Github Issue](https://github.com/satori/go.uuid/issues/73)\n"
                            functions: []
                            from:
                              - github.com/satori/go.uuid@v1.2.0
                            package: github.com/satori/go.uuid
                            version: v1.2.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: golang
                            packageManager: golang
                            semver:
                              hashesRange:
                                - '>=0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c <d91630c8510268e75203009fe7daf2b8e1d60c45'
                              vulnerable:
                                - =1.2.0
                              vulnerableHashes:
                                - c596ec57260fd2ad47b2ae6809d6890a2f99c3b2
                                - 36e9d2ebbde5e3f13ab2e25625fd453271d6522e
                                - f6920249aa08fc2a2c2e8274ea9648d0bb1e9364
                                - 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c
                            publicationTime: 2018-10-24T08:56:41Z
                            disclosureTime: 2018-03-23T08:57:24Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-338
                            credit:
                              - josselin-c
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 8.1
                            patches: []
                            upgradePath: []
                        licenses:
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl/json/token@v1.0.0
                            package: github.com/hashicorp/hcl/json/token
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl/json/scanner@v1.0.0
                            package: github.com/hashicorp/hcl/json/scanner
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl/json/parser@v1.0.0
                            package: github.com/hashicorp/hcl/json/parser
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl/hcl/token@v1.0.0
                            package: github.com/hashicorp/hcl/hcl/token
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl/hcl/strconv@v1.0.0
                            package: github.com/hashicorp/hcl/hcl/strconv
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl/hcl/scanner@v1.0.0
                            package: github.com/hashicorp/hcl/hcl/scanner
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl/hcl/printer@v1.0.0
                            package: github.com/hashicorp/hcl/hcl/printer
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl/hcl/parser@v1.0.0
                            package: github.com/hashicorp/hcl/hcl/parser
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl/hcl/ast@v1.0.0
                            package: github.com/hashicorp/hcl/hcl/ast
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
                            title: MPL-2.0 license
                            type: license
                            from:
                              - github.com/hashicorp/hcl@v1.0.0
                            package: github.com/hashicorp/hcl
                            version: v1.0.0
                            severity: medium
                            language: golang
                            packageManager: golang
                            semver:
                              vulnerable:
                                - '>=0'
                              vulnerableHashes:
                                - '*'
                      dependencyCount: 101
                      org:
                        name: atokeneduser
                        id: 689ce7f9-7943-4a71-b704-2ba575f01089
                      licensesPolicy: null
                      packageManager: golangdep
      deprecated: false
  /test/govendor:
    post:
      tags:
        - Test
      summary: Test vendor.json File
      description: >-
        Test for issues in Go vendor files.You can test your Go vendor packages for issues according to their manifest file using this action. It takes a JSON object containing a "target" `vendor.json`.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testvendor.jsonFile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/govendorrequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: '{\"comment\":\"\",\"ignore\":\"test\",\"package\":[{\"checksumSHA1\":\"o/3cn04KAiwC7NqNVvmfVTD+hgA=\",\"path\":\"github.com/Microsoft/go-winio\",\"revision\":\"78439966b38d69bf38227fbf57ac8a6fee70f69a\",\"revisionTime\":\"2017-08-04T20:09:54Z\"},{\"checksumSHA1\":\"GqIrOttKaO7k6HIaHQLPr3cY7rY=\",\"path\":\"github.com/containerd/continuity/pathdriver\",\"revision\":\"617902de2ab5e18974efd88a58eeef67ac82d127\",\"revisionTime\":\"2017-09-25T16:43:31Z\"},{\"checksumSHA1\":\"ndnAFCfsGC3upNQ6jAEwzxcurww=\",\"path\":\"github.com/docker/docker/pkg/longpath\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"IVWozKA/coqhti24Ss2b1nLrTSg=\",\"path\":\"github.com/docker/docker/pkg/mount\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"YdUAOhhc/C0zu+eYrJOJjDwr1/4=\",\"path\":\"github.com/docker/docker/pkg/symlink\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"UEMAKQqAyL9hs6RWxesQuYMQ3+I=\",\"path\":\"github.com/docker/docker/pkg/system\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"UmXGieuTJQOzJPspPJTVKKKMiUA=\",\"path\":\"github.com/docker/go-units\",\"revision\":\"0dadbb0345b35ec7ef35e228dabb8de89a65bf52\",\"revisionTime\":\"2017-01-27T09:51:30Z\"},{\"checksumSHA1\":\"RCARG9BoOH6jwbqnuix2Ne3K26w=\",\"path\":\"github.com/docker/libcontainer\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"OVGl5SGmF1HZmaG6JRmkyWiycYA=\",\"path\":\"github.com/docker/libcontainer/cgroups\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"q56oWh80PeIBiE/8nQ/Emz18ZZ8=\",\"path\":\"github.com/docker/libcontainer/cgroups/fs\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"3NQtWwKOT4BlnSWn0tTsy/N+XhU=\",\"path\":\"github.com/docker/libcontainer/console\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"WPIuCuWS1RkrGCHBRZuOJku7ZBc=\",\"path\":\"github.com/docker/libcontainer/devices\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"HLo2E8AWKNCwE2p7ndEkKc4SPnM=\",\"path\":\"github.com/docker/libcontainer/label\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"KYcr4bHkervvLS5wuH9w1+EhflY=\",\"path\":\"github.com/docker/libcontainer/mount\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"tvHnvhbm17pLR/fA2WXWYlY9aDs=\",\"path\":\"github.com/docker/libcontainer/mount/nodes\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"k9+kwIouq8vqmodLrGFp+9I7Jxs=\",\"path\":\"github.com/docker/libcontainer/netlink\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"ndpCrSi/XKZNCCrkjpQ2cgMIxKA=\",\"path\":\"github.com/docker/libcontainer/network\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"cfgnX7wKfSHOJ4mbhKyjAWizl+s=\",\"path\":\"github.com/docker/libcontainer/selinux\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"M7/2WUk1uzgdqc5Ce/k9UcSyv1M=\",\"path\":\"github.com/docker/libcontainer/system\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"2ZMmNaPI3TM4WyMjCw+h1jErSr0=\",\"path\":\"github.com/docker/libcontainer/utils\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"rJab1YdNhQooDiBWNnt7TLWPyBU=\",\"path\":\"github.com/pkg/errors\",\"revision\":\"2b3a18b5f0fb6b4f9190549597d3f962c02bc5eb\",\"revisionTime\":\"2017-09-10T13:46:14Z\"},{\"checksumSHA1\":\"BYvROBsiyAXK4sq6yhDe8RgT4LM=\",\"path\":\"github.com/sirupsen/logrus\",\"revision\":\"89742aefa4b206dcf400792f3bd35b542998eb3b\",\"revisionTime\":\"2017-08-22T13:27:46Z\"},{\"checksumSHA1\":\"nqWNlnMmVpt628zzvyo6Yv2CX5Q=\",\"path\":\"golang.org/x/crypto/ssh/terminal\",\"revision\":\"847319b7fc94cab682988f93da778204da164588\",\"revisionTime\":\"2017-08-18T09:57:21Z\"},{\"checksumSHA1\":\"uggjqMBFNJd11oNco2kbkAT641w=\",\"path\":\"golang.org/x/sys/unix\",\"revision\":\"429f518978ab01db8bb6f44b66785088e7fba58b\",\"revisionTime\":\"2017-09-20T21:38:28Z\"},{\"checksumSHA1\":\"pBPFzDGt3AVSRffB7ffiUnruFUk=\",\"path\":\"golang.org/x/sys/windows\",\"revision\":\"429f518978ab01db8bb6f44b66785088e7fba58b\",\"revisionTime\":\"2017-09-20T21:38:28Z\"},{\"checksumSHA1\":\"o5NrWoSkC+ugoK9D6ragLSrXHw0=\",\"path\":\"gopkg.in/square/go-jose.v2\",\"revision\":\"296c7f1463ec9b712176dc804dea0173d06dc728\",\"revisionTime\":\"2016-11-17T00:42:38Z\",\"version\":\"v2.0\",\"versionExact\":\"v2.0.1\"},{\"checksumSHA1\":\"j94zYNLTvPSnfnqVKJ4LUf++uX4=\",\"path\":\"gopkg.in/square/go-jose.v2/cipher\",\"revision\":\"296c7f1463ec9b712176dc804dea0173d06dc728\",\"revisionTime\":\"2016-11-17T00:42:38Z\",\"version\":\"v2.0\",\"versionExact\":\"v2.0.1\"},{\"checksumSHA1\":\"JFun0lWY9eqd80Js2iWsehu1gc4=\",\"path\":\"gopkg.in/square/go-jose.v2/json\",\"revision\":\"296c7f1463ec9b712176dc804dea0173d06dc728\",\"revisionTime\":\"2016-11-17T00:42:38Z\",\"version\":\"v2.0\",\"versionExact\":\"v2.0.1\"}],\"rootPath\":\"with-vuln\"}'
            example:
              encoding: plain
              files:
                target:
                  contents: '{\"comment\":\"\",\"ignore\":\"test\",\"package\":[{\"checksumSHA1\":\"o/3cn04KAiwC7NqNVvmfVTD+hgA=\",\"path\":\"github.com/Microsoft/go-winio\",\"revision\":\"78439966b38d69bf38227fbf57ac8a6fee70f69a\",\"revisionTime\":\"2017-08-04T20:09:54Z\"},{\"checksumSHA1\":\"GqIrOttKaO7k6HIaHQLPr3cY7rY=\",\"path\":\"github.com/containerd/continuity/pathdriver\",\"revision\":\"617902de2ab5e18974efd88a58eeef67ac82d127\",\"revisionTime\":\"2017-09-25T16:43:31Z\"},{\"checksumSHA1\":\"ndnAFCfsGC3upNQ6jAEwzxcurww=\",\"path\":\"github.com/docker/docker/pkg/longpath\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"IVWozKA/coqhti24Ss2b1nLrTSg=\",\"path\":\"github.com/docker/docker/pkg/mount\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"YdUAOhhc/C0zu+eYrJOJjDwr1/4=\",\"path\":\"github.com/docker/docker/pkg/symlink\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"UEMAKQqAyL9hs6RWxesQuYMQ3+I=\",\"path\":\"github.com/docker/docker/pkg/system\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"UmXGieuTJQOzJPspPJTVKKKMiUA=\",\"path\":\"github.com/docker/go-units\",\"revision\":\"0dadbb0345b35ec7ef35e228dabb8de89a65bf52\",\"revisionTime\":\"2017-01-27T09:51:30Z\"},{\"checksumSHA1\":\"RCARG9BoOH6jwbqnuix2Ne3K26w=\",\"path\":\"github.com/docker/libcontainer\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"OVGl5SGmF1HZmaG6JRmkyWiycYA=\",\"path\":\"github.com/docker/libcontainer/cgroups\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"q56oWh80PeIBiE/8nQ/Emz18ZZ8=\",\"path\":\"github.com/docker/libcontainer/cgroups/fs\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"3NQtWwKOT4BlnSWn0tTsy/N+XhU=\",\"path\":\"github.com/docker/libcontainer/console\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"WPIuCuWS1RkrGCHBRZuOJku7ZBc=\",\"path\":\"github.com/docker/libcontainer/devices\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"HLo2E8AWKNCwE2p7ndEkKc4SPnM=\",\"path\":\"github.com/docker/libcontainer/label\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"KYcr4bHkervvLS5wuH9w1+EhflY=\",\"path\":\"github.com/docker/libcontainer/mount\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"tvHnvhbm17pLR/fA2WXWYlY9aDs=\",\"path\":\"github.com/docker/libcontainer/mount/nodes\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"k9+kwIouq8vqmodLrGFp+9I7Jxs=\",\"path\":\"github.com/docker/libcontainer/netlink\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"ndpCrSi/XKZNCCrkjpQ2cgMIxKA=\",\"path\":\"github.com/docker/libcontainer/network\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"cfgnX7wKfSHOJ4mbhKyjAWizl+s=\",\"path\":\"github.com/docker/libcontainer/selinux\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"M7/2WUk1uzgdqc5Ce/k9UcSyv1M=\",\"path\":\"github.com/docker/libcontainer/system\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"2ZMmNaPI3TM4WyMjCw+h1jErSr0=\",\"path\":\"github.com/docker/libcontainer/utils\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"rJab1YdNhQooDiBWNnt7TLWPyBU=\",\"path\":\"github.com/pkg/errors\",\"revision\":\"2b3a18b5f0fb6b4f9190549597d3f962c02bc5eb\",\"revisionTime\":\"2017-09-10T13:46:14Z\"},{\"checksumSHA1\":\"BYvROBsiyAXK4sq6yhDe8RgT4LM=\",\"path\":\"github.com/sirupsen/logrus\",\"revision\":\"89742aefa4b206dcf400792f3bd35b542998eb3b\",\"revisionTime\":\"2017-08-22T13:27:46Z\"},{\"checksumSHA1\":\"nqWNlnMmVpt628zzvyo6Yv2CX5Q=\",\"path\":\"golang.org/x/crypto/ssh/terminal\",\"revision\":\"847319b7fc94cab682988f93da778204da164588\",\"revisionTime\":\"2017-08-18T09:57:21Z\"},{\"checksumSHA1\":\"uggjqMBFNJd11oNco2kbkAT641w=\",\"path\":\"golang.org/x/sys/unix\",\"revision\":\"429f518978ab01db8bb6f44b66785088e7fba58b\",\"revisionTime\":\"2017-09-20T21:38:28Z\"},{\"checksumSHA1\":\"pBPFzDGt3AVSRffB7ffiUnruFUk=\",\"path\":\"golang.org/x/sys/windows\",\"revision\":\"429f518978ab01db8bb6f44b66785088e7fba58b\",\"revisionTime\":\"2017-09-20T21:38:28Z\"},{\"checksumSHA1\":\"o5NrWoSkC+ugoK9D6ragLSrXHw0=\",\"path\":\"gopkg.in/square/go-jose.v2\",\"revision\":\"296c7f1463ec9b712176dc804dea0173d06dc728\",\"revisionTime\":\"2016-11-17T00:42:38Z\",\"version\":\"v2.0\",\"versionExact\":\"v2.0.1\"},{\"checksumSHA1\":\"j94zYNLTvPSnfnqVKJ4LUf++uX4=\",\"path\":\"gopkg.in/square/go-jose.v2/cipher\",\"revision\":\"296c7f1463ec9b712176dc804dea0173d06dc728\",\"revisionTime\":\"2016-11-17T00:42:38Z\",\"version\":\"v2.0\",\"versionExact\":\"v2.0.1\"},{\"checksumSHA1\":\"JFun0lWY9eqd80Js2iWsehu1gc4=\",\"path\":\"gopkg.in/square/go-jose.v2/json\",\"revision\":\"296c7f1463ec9b712176dc804dea0173d06dc728\",\"revisionTime\":\"2016-11-17T00:42:38Z\",\"version\":\"v2.0\",\"versionExact\":\"v2.0.1\"}],\"rootPath\":\"with-vuln\"}'
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Testvendor.jsonFileresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-GOLANG-GITHUBCOMDOCKERLIBCONTAINER-50012
                            url: https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDOCKERLIBCONTAINER-50012
                            title: Symlink Attack
                            type: vuln
                            description: >
                              ## Overview

                              Affected version of [`github.com/docker/libcontainer`](https://github.com/docker/libcontainer) are vulnerable to Symlink Attacks.

                              Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.


                              ## References

                              - [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3627)

                              - [GitHub Commit](https://github.com/docker/libcontainer/commit/46132cebcf391b56842f5cf9b247d508c59bc625)

                              - [Packetstorm Security](http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html)

                              - [Seclists](http://seclists.org/fulldisclosure/2015/May/28)

                              - [Docker Security Advisory](https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ)
                            functions: []
                            from:
                              - github.com/docker/libcontainer@v1.4.0
                            package: github.com/docker/libcontainer
                            version: v1.4.0
                            severity: critical
                            exploitMaturity: no-known-exploit
                            language: golang
                            packageManager: golang
                            semver:
                              hashesRange:
                                - '>=5c246d038fc47b8d57a474e1b212ffe646764ee9 <46132cebcf391b56842f5cf9b247d508c59bc625'
                              vulnerable:
                                - <1.6.1
                              vulnerableHashes:
                                - cab4b9bce1bece1b6c575e1826f3e5b221faebf3
                                - 4a72e540feb67091156b907c4700e580a99f5a9d
                                - eb74393a3d2daeafbef4f5f27c0821cbdd67559c
                                - 4332ffcfc6765245e8e9151a2907b0e4b76f218f
                                - 7eceabd47f41328d6e894418ae167ce8377bda22
                                - ecace12e5a3e309d82c5b3b1548a3251b3bc4e2a
                                - afb167a417ed8379c008b070fb5c0b1bc84bbcba
                                - 2b4512809110033e5ec532167efd6fabf2dd596d
                                - c2403c32dbf8a67870ab2ba7524c117fc0652256
                                - 4077c254a6ac99930d720a9b95709dbd2614bc61
                                - 1b755bf962ec1d29e9e5e66e2cc15704fac088e7
                                - 1c9de5b4d21b94499a1e91c9b94ba06831ac5393
                                - e3184f97e040c3121502dc382d41ac58a98b685a
                                - 0dee9793d5efd9842a2e8890fa0f8981d20b196e
                                - 3e9299d6da5749b263fc3dc93d50b5c854fa199c
                                - 152107f44ae9e38b38609fdbc75ac6f9f56c4fed
                                - 623fe598e4d5e75e70440f45298eecec414788b3
                                - e30793aed7a30772054abfb1b3f3f703f119b55b
                                - 0596e6384a586223c56c5ea7d14467ebf5d17247
                                - 42fed751fbab3f340461d06edb896cd10cd49812
                                - e451df796aaa605413a0b84ddd1bf39ec4a751a0
                                - b0eece8d7d945e1e7fc98c2ae3b7dd0a860a7c2a
                                - 5c246d038fc47b8d57a474e1b212ffe646764ee9
                                - bfa67ab988f434fd6836c1868eb5d7d1d7864e8a
                                - 9bebc660423ca974192599a6a5ea8e016a6fe1fc
                                - e22b58954324b3593737438032412f15ed9602e9
                                - af371eae767ceb51b8804f212bf97584d876feb3
                                - f61899ece3fc1da206a0eb28fada0595ab381887
                                - 0d0402712b5a13d1b54a345a63ec67982e2e0089
                                - d1ae7cd67310f482af22de3abeb26d28e65274bf
                                - 9f2c67332f48c0050846ac86e01cb5dadbd1d8fe
                                - 62bdfc482d8edaa618b544fb2beafdf0c44dce5e
                                - 699429e60f23ab0fa3bdd97b6326316be08791ad
                                - 35c01f9eb3c228201a3fc5d2301d1fc7a00bde13
                                - a72f710d89eaabf23dad7c084082bccb26e6336f
                                - eb84dd1b73df035e6e64c8513daaa476c72dedfc
                                - 5b73860e65598203b26d57aabc96ae0f52c9f9ab
                                - d64cfe5c05448935c75c92f65d604c751bbf5153
                                - 62626677876330d60fe3512f59f1fd8f82799ca5
                                - 43842efeccbd8077dba8f85fc9e772e0647b82cb
                                - d6cd7ce43faa53d212052dbbcf209029ec2ec951
                                - ebefcddc3c4b99ae312ac575c288856e177ed6ef
                                - 83add60f217d32561ff0ff62ebf1d6db6a2a11a3
                                - 14af6755f04233fbe55cb354a9351fe05afd43a0
                                - 8530167f7f5b5eb329f5377b6b74a904482a10ed
                                - 000d36e109f5d04bad5342bb779e02b2b9b252f7
                                - 1db687f4f480c06e6cadfdb0971985df4313ddc7
                                - 689e8ec9493a4294856dc1568f5ef667e106707c
                                - 0eb8a1aac3d903b3c7925208c34f09c02910e7aa
                                - edb31ce0a6fd7956bffc0829000c60bdd56b9f32
                                - 53fce307557cbffdbc54647ef63956b2cb0cee86
                                - c22d5c90cf907f4f34d2bc13cad9c82a7fce9077
                                - ef1c1c4289559e818d3ec77ce9c1b6a77d2ac764
                                - 2da44f8c7b703f87e9c07164c9cc1cdd31031783
                                - ee102305fb35a23668136b102ed4d0dd5b3d9ce5
                                - 3ca0e1ff95c54577c65b5fbb734c267c23782974
                                - f115a5f6c8c2a3cc6340408e6644236a88dcaad0
                                - 29ba9b3179d014cc87129af5c51b1263443f387b
                                - c1ca18404fa63209e0a65abf443669155991b4df
                                - 5bb81469895d669ddcb4b49e83809a980d57d6b1
                                - 6feb7bda04b3130e81cf9606ddb7a156d4a63f7a
                                - 7c8550af53b4d428d8f3a7c19c0c4a8ebca8ff21
                                - 7766c1e07bd49fdc290f0557268950d35b867823
                                - 4903df2ed52a01f08626739ad35937752de82a09
                                - 58feafa848d9657dda34e5ccc3a196e359566bda
                                - 9e787db1b108941edab18209a7468e6c555002ce
                                - e7953c3609b62a25b0bfedcd9d3885ca1b99d2fb
                                - 8c3b6b18689796bc9625258258e8664746b24e85
                                - dd3cb8822352fd4acc0b8b426bd86e47e98f6853
                                - cc524f1b729cb5d7592d0a0b07cb3ff1fe6eda98
                                - c22ac4876f0a218584ae862900f3058470be38a3
                                - c1fb904d1047359e8c4dadafaa0ab065efe9e03e
                                - 1f176f3c0dae283d66df5360de8a93ec14b4fbd0
                                - 50f0faa795dc62773857a0cc3cfb6d5681ba3562
                                - 3fbf1856025f54b6eab6e73b7ff8aa4d1020e1c1
                                - f4a4391e4ef7e886e56816ae59cbe99d8cff91d9
                                - 2d9ef3af72e89ad9df164bd0f435371aa4fa0dea
                                - 187792e35bb47c89fdfe34409162c814627daacc
                                - b322073f27b0e9e60b2ab07eff7f4e96a24cb3f9
                                - f78bf211f023d28392c6aa0d1934bb1001b3a180
                                - 20af7e70e2511b4da0e035bf2fa2d6295f198970
                                - f8eb40433c4a8617a20ad36119973af6f9dd2cd0
                                - d7dea0e925315bab640115053204c16718839b1e
                                - 295c70865d10d7c57ba13cbef45c1d276ebfa83e
                                - 5a87153824b838be92503b57e76e96519b84b522
                                - fec4c5ab0a75d7e6a46955bda0818bed7f8fecf3
                                - 6a76ecb1ce53d9e623826b238033b86f072395a9
                                - 2c037b7fd98e1c03e0c67ceccfd8e3300457e07e
                                - 4ce8d973204ebace2970c662f6f841ab11a3cc13
                                - 870119e763b5976d7331fbd8656ed65207ba95ad
                                - 58fc93160e03387a4f41dcf4aed2e376c4a92db4
                                - a3b0209cc61301941810e54bc3678ccff9af71c1
                                - ec005e73b9169d17651618b91836a5d86eb7b24c
                                - 2fac2dad91e390acb8937ede6154c265b7011cf9
                                - 0195469398f4fc1d42c0c20172b51e03ccf9ff1a
                                - 8d0b06257ba659ee91fa3862ed358cecbee37f73
                                - 6516e6ce8c7c71e44f95332ef740ea4082cfee39
                                - 55d61e22c5e0e4dc00c99847ba20a8ffa1e3a3d4
                                - ca73d7aede7eaa05f4a0acb4bd5cb17a9408cd27
                                - 43fabe36d18fa36326d9e5efd2cca8b9376a7fdf
                                - c06f92353f4f74cdb1c66ee0bbae1cdbb46934ce
                                - d6fae7bb26807a386f5dd9a1ec2dc5ac51c24498
                                - bde8bf2ebc5630399c7d0965f58b502100180400
                                - 444cc2989aca50986b45a56bfd8a32bd7ea23c1c
                                - f5dfd9a702ad163be35023fe08c9573a614d6121
                                - 6c2f20eeeca488b98a613e013712d7c9a3d1e619
                                - cc42996625afaf38d281f2457b08551a3df0d7bc
                                - 903680701ad5cf25484d0ac3e78152807dfa90b3
                                - 69228248334a576549a9af9df389b3cbfe0c211c
                                - 6460fd79667466d2d9ec03f77f319a241c58d40b
                                - 7d9244eab20fc96230636a066f88ad5165c34bc7
                                - 9387ebb6ba5fca526aedb54c7df684102639caa3
                                - b21b19e0607582cceb8d715b85d27ec113a0b799
                                - c4821b6f3e0a41af6bf3ed1cfa168c13381b9554
                                - 397b675315d00a34a09f058dd7e462af6f715da3
                                - c504f85aabbff0d7380ca9da3f6051c56905c7c0
                                - 0f8f0601ae5668510ab7bde03041dafd39b18ec6
                                - c3ab8d0cb4b439b7691edf7b63fcecd169834250
                                - 22df5551ed7367eb9cbb0cc22aea46351d2495ad
                                - d284fdfaa36d37cbba5749562d6f9303ebab7d2f
                                - a9a503082e492575be352c9c82040c1f4ed468d1
                                - 5fedffd8fd387b24b25186622c9566325ab3db1b
                                - dc827aa0ee51829d292524fdf3a7a163feadabe2
                                - f925aa3503eeba9d372c74d1fe2b17c8ecd97960
                                - bc1d229dbe94a0100f4530b47e9c918f27b8cecd
                                - 71a57166c1209103dcd4355d21c161bd0f09e481
                                - a9644c209f7764f9155db0c4aeb4f690c0cdb585
                                - bcfdee970e8a32d04b472cd2c5712e10a5e425fe
                                - 3c474b9e2aad7c577faefca6c35a8512140c0c65
                                - c34b3d5ce90a6b2828d5b97f553f4b49f64081af
                                - 286fffa4eeda7745f3b36dc938dae3e155d1b204
                                - d1f0d5705debbe4d4b1aed7e087d5c49300eb271
                                - 08fdb50b03dc810ca8c4386f4f8271a8d51d4445
                                - c44ab12c86689065978950d2ed92bb131b2a932c
                                - 5df859ad240af502aebef01ca28da3ef24951e05
                                - ef4efd065cb6c136c7fcbdd65285cff549b745ac
                                - 2f1b2ce204490854938fab57142b557caa4ab66d
                                - a36d471a0ef4e119ecfb41257aad246464024a40
                                - 83663f82e3d76f57ea57faf80b8fd7eb96933b9b
                                - e8f5b543010eb0db146fd2593284ed19af93eccd
                                - c8512754166539461fd860451ff1a0af7491c197
                                - dc4c502efd85727abfed95af7789caa7f10d020d
                                - 4940cee052ece5a8b2ea477699e7bb232de1e1f8
                                - 025e6be6c5dc3d535286461088416afa74c42927
                                - b4cda7a6cabf1966daf67f291c2c41ff9a1369f4
                                - 074441b495052c456f4b96524bd7a80d00db42e8
                                - 5847aacb32742fd734fa2c0584cae65636bba370
                                - f9590b0927744d22ad0e1b737eecd07a48bb4c2f
                                - e05f807a8936b4491632290f13958ca26d0aaace
                                - fd0087d3acdc4c5865de1829d4accee5e3ebb658
                                - 38f729e577e07b2c3333ed4b04146e1d64f665a8
                                - 8a8eb57746e5372080a5f5e5b6fb9dce178c8220
                                - afa8443118347a1f909941aec2732039d28a9034
                                - d6eb76f8a2184688489fc3a611d80de36ef50877
                                - 0f397d4e145fb4053792d42b3424dd2143fb23ad
                                - ba613c5a847ff30d312726eeff444714f8e31cde
                                - 445bebc1b16b1f2646a3cae841fe0e1266d79ada
                                - e2ed997ae5b675fc8e78e7d0f9e6918c8b87503c
                                - 3b95acdfa1e54de15cae2fc3083147a185a31792
                                - cacc15360ec04abb4c45f918e83bf33203946e32
                                - 09809b551ce9f05e96fc3055ae7a23329604415b
                                - 2a9511a0266afd48251609a03533094afe22fce2
                                - b6cf7a6c8520fd21e75f8b3becec6dc355d844b0
                                - fc3981ea5c10fb21cae6d6a8e78755be5b169999
                                - dc34fe188385f42198997f6aedc170487c57c7eb
                                - e9f8f8528abef64b8e1b8bc046a008b009ab2417
                                - fe9f7668957641a404b0d2c8850f104df591e7f2
                                - 8da9c6878fa29f33dcfd74b1146d457a576d738a
                                - 4622c8ac9541790365eda22b6ce65d038f4026fe
                                - 3977c892e78d91a0c6d2a34fd2512a6c53c8d924
                                - 1bd146ed82f771395f991851f7d896d9ae778f3c
                                - 77085907a44039fe1cf9fe24d9c7675aa53d2f9b
                                - 107bad0ee5141bb847257a6f57dff2469dd584da
                                - 2da159823d0a54756308e73dc0e58a420daffad4
                                - 94fb37f5573e1484ba686b195079684cace18eb0
                                - 5c6332687d5d7c902cdd954e4e6a107ed6c60848
                                - 8b77eba9a6b506c71d1542d2fab1495249a7f7b6
                                - da32455210de558c829f089e8c3a3d1ed8c34a5b
                                - e1c14b3ca245fd06ef538005cd3a250904be5b4c
                                - f0d1a8fc27830b899c5789ba2f80dfa9458792a4
                                - 846e522ffc157c12ba244c2c8a2c6adb1ed789f7
                                - 2a452c17aa2417cd89b5e25e8549f9e09c94a0dc
                                - 3cd416efe1e5b7d1679a20a91a73d757d481633b
                                - e0de51f53c6b2711f39f4f29eb58b63a9ebf2c5c
                                - f7837f4f717a9f09cf34fc325061ee8e38d1100a
                                - 13a5703d853fbd311e1fcfc5c95d459021781951
                                - 2aebf7d849e47ca927de332b82983ba8fe03d062
                                - 56bc1485df0ac0c2fe8ae5e0499e50a0580f2522
                                - 8d0f911e1d9265a8f362a7a16b893f7c40aee434
                                - dc82e30089dbba31a1d0cf459321486a9b546fa0
                                - 4d863b7bd0d7da6ca1108031fd7d7997bf504496
                                - 73ba097bf596249068513559225d6e18c1767b47
                                - da109f3af037352af24f935b1ea57ba8a7f26cad
                                - 3c52181f613353cc3b8aefbbf637c15a11cb8242
                                - c96cde4e5db0da7e798e2712c2312f2468720a98
                                - 52a8c004ca94cf98f6866536de828c71eb42d1ec
                                - b89112c542edcc9cf5af75694c16af28a3e4f12b
                                - c099a20eb8bd084c17d9348bd0f6bef066ea514f
                                - 8067e34ec01588d2952d57e21c8c637fd3d3d114
                                - 9d4f6b3d3d4feba35ea13097be415bf099b670ce
                                - 334b1963711b743bf014502c5513a82a23eb65cc
                                - 190e50b08dbd72fd1d9f21f20581fa27a498481c
                                - 4c43b0f49880840966cb5df13abeeb19aa8e16d7
                                - 9946e299af9e911a54c83626f245dff20127e442
                                - 9825a26db570697e058a4580ec3b71ab3d82fc24
                                - f8daab8a96fe2c73974073696d00deb4ffb40d47
                                - 88989e66d3a1ab960deb37f3dd7f824d85e1b9bc
                                - c5eef904604b7e22083927bb99ea0c196d4cb8b9
                                - 4661c239dc6394aba960ba73144f2a7e3859537f
                                - 9303a8f15f6e55931a08542636922c1bf041ad52
                                - 9d91f080ced0bbfcbd3c003e2a20c9cdc81bc4ff
                                - 99233fde8c4f58853a474a5831ef0bcf6bf866c5
                                - 14a7d2f468404e25577dced6982248e80ddce79a
                                - b6a1b889852cd6b365833ce2b04a0c1092867f75
                                - 5d6c507d7cfeff97172deedf3db13b5295bcacef
                                - b89cd0cf5cf5deec2ed6fdc0d8ed4e4f3167aeb4
                                - be02944484da197166020d6b3f08a19d7d7d244c
                                - c37b9125ecaad0c100b6851baacf97adfa2339d6
                                - 045e9ae4a0fa8bff397b3c4f2614a3e609e6dd66
                                - 9744d72c740dd8cdfbb8cb4c58fb235355e0a0b4
                                - 74005ed4e0cdbc87ce40c6b79edfd599ba2355e9
                                - 1d7207079fc6ab5b2cbfedda3fc8993bc4441b02
                                - 8961fd20e6e213bf967db90166e24d38da065807
                                - dd5576b2b3f5667811f882d1f64a11e13164791a
                                - 8600e6f3158bafe927706f0613c1520971d16c32
                                - e9c1b0144ae784df9d26f59bfadd8cb2fc3a1d69
                                - 6423c8d2613e5130e9c37620773d2173c76f0acd
                                - b48acf4613cc5347ca10b6d6edd6e1b94a5378c4
                                - 6c285c1d4964662ac64f0b98620d154caf423d79
                                - 312f997de638b8c18f92a59596a984bdb1a06a4e
                                - 11d14f2621370a527d2401c8bba10d2408819131
                                - a6044b701c166fe538fc760f9e2dcea3d737cd2a
                                - 91a3f162afc90339b1d8f8d2f22d9c4271eddb84
                                - 54301f55934f42598b8f7c88effc4bd588e5f3e7
                                - 29f5cb6b391eea625c512df1f2ae7d9efccfbae9
                                - 087caf69e8cabd8f1f66f6239079b60172c9fb78
                                - 21ed4766b1523373b0463af497ef1c6b3b98c2ca
                                - 30b33064169e09e1c5daacb38ed461ed5820d0d2
                                - a8a798a7c9b1da5beea8acfec16409d015ad85a7
                                - a4f2e1e1878c1ce541aec24e6e2a690855cc8003
                                - d06a2dab9f185c8cd2c21c0c97342cbdb7b9f38b
                                - 12a63757dbde3b0be25b49bc9e7625059088d319
                                - 35ae1c48710ff5a4db20645bc98c719cfb695b9a
                                - 85cd86999f70339509692b92cf182ec36697edcf
                                - 10d49f830b52ed05d9b41e18c8e1ff4a44a85fb3
                                - 3f35b26b8b2dcd856b12b985f9091260d5c5bd71
                                - 1a37242fa2af5db30ea72b95f948285efcd63d52
                                - b49bd705dcddd496aedb6e797ce8691d276236af
                                - eb2ae34c80f6b8ffb1bdfc55287d967c6e18cd81
                                - 39fbf0a90423a1e6e31c6c042acd9aea00793a18
                                - d658fb8a2566cab11600af4db164c5f1f8656116
                                - f4cf808a3d184c556a51cd53d98a2f4ea05acee4
                                - bdff595cad6a42ba9675f99505bebecdb28209f0
                                - 9377591781a5346ed84517688787c305ed6554c4
                                - 19099e065da7c810f93e83d68c0776c2336e5e03
                                - a1ac9b101571477a81e1cb3c6999f818bbbf0738
                                - 54968f68bc2ba50f59a66fba9f6823215a0bc4f6
                                - 9455a8ce3aaccceb4c282ef6c84d7edb36dd0d4c
                                - 21c344a479a8fd359a9c875f3056a7e72fe4d5fb
                                - 00abcf89d9ad026ddce4af0038db7953b01d8b8b
                                - 1a246dd54326124df57cb0e8e051f57abb549c9f
                                - 07db66a6ef857edee2c731d1b66f42a4f32d9622
                                - d4867a6583c17001a60590684d91237a580e786a
                                - 46573774a27c7a4d20d508f1f07ba72d34616bc3
                                - 9184d9473d7b5ecb0dddca4052171534523602be
                                - f6593810da73cf8e1cc982d9020850260fc1ff52
                                - a9442e6660e71fd2058310e6155de3ef5e4f5fdf
                                - cee97cb0ccad90c369b10d6a9512d678a0535cac
                                - aaca2848a1e1eefa71ce2987b19abae2d34cf3aa
                                - 3125b53b1aef485ed2239d514b131ef80ad577c1
                                - 2990f254f030e62ab15b9399e26368aa3e291d15
                                - b19b8a9677ae9e657e0195ac85a4849a67729cf6
                                - e3b14402ebded2a7ec8f38809bf907ac72692ede
                                - 37d229d0262b6fa7dfb96184eff3f7882ddd487e
                                - 8002fd226367c0882973c69673bf8379df2fc198
                                - a1c3e0db94579f59cc821132f958187339e68d88
                                - 4fdec5a8e10f95a5dbfd84cf382f2755f0342fda
                                - ef73d7e235c4d4ab41402835193ac9ba0c4cc485
                                - ad3d14f1da33d00ee3506f12922fb3faf87b65d7
                                - a1d509759b9195a1c022f2eb9585b74d07a0f084
                                - b7e54b0b41757cd36dd03fb29367b385c5fa3be0
                                - d909440c48b7b64b016478de1e6ee78e2faa9e13
                                - 2ca9dc306e8c667eb9f00376898be52d8b980c88
                                - 031524c73df6fd40b13e89c44e86d4a62d77075b
                                - 6fae0d4fa68a85a1d552c5ae3140dd39f7a05c88
                                - fb27b4238cd6c33bd899e240ead4b5fb8a2a24b1
                                - 0890cc54a92627c03119654c94c584a2e3c744ca
                                - 339edce03ed7fe59ec4a778abff243fa4cabaa23
                                - 2329014b6dbc473326291fa6e101e6d63c4dbd25
                                - 872663148e00c4d272fc67e8d369a5012ccbac5a
                                - 0e3b1262a168d51512014c4f7df6c37edce0f05d
                                - 606d9064b0a6abd82da3731fda9f1558ec1f153c
                                - 4bd39999a06fa1f710daae54c6cc8ca7d5784f58
                                - 562cd20d05e0427e6b18daa279a3a5f3b08c889d
                                - 4bbd44784c7c4eede8e53011a2c4981c16598d1f
                                - dc4bd4cece9a6de7926e85a09f152fe4697a8bc5
                                - 770e2583907fa38e2b78601a90799b6ae7ab15eb
                                - f34b3b765fb964dee979ac7646b6d609adbeb2ba
                                - aa10040b570386c1ae311c6245b9e21295b2b83a
                                - fff015f4094ab80ff2eb4978f8cdb3711187c50a
                                - 5b2be7d9d8444e0a5b706944c878cd0048ef026a
                                - 2cd0ee8cf21eecaa9d39d699692284be44cf6ca2
                                - 451043367be65468dd96bbf5868af666b25f1663
                                - 4fc29224cf362988a741dc07804225f730a326ec
                                - dd6bc28afb3bafdde93ad7ed9f58b3a0aec2be99
                                - 1597c68f7b941fd97881155d7f077852e2914e7b
                                - e59984353acde7207aa1115e261847bf4ddd9a8f
                                - ee1000e153e1b7c8f223bb573bb8169d2033f4af
                                - 1d3b2589d734dc94a1719a3af40b87ed8319f329
                            publicationTime: 2015-08-06T00:00:00Z
                            disclosureTime: 2015-05-18T15:59:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-3627
                              CWE:
                                - CWE-59
                            credit:
                              - Tõnis Tiigi
                            CVSSv3: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 8.4
                            patches: []
                            upgradePath: []
                        licenses: []
                      dependencyCount: 28
                      org:
                        name: atokeneduser
                        id: 689ce7f9-7943-4a71-b704-2ba575f01089
                      licensesPolicy: null
                      packageManager: govendor
      deprecated: false
  /test/yarn:
    post:
      tags:
        - Test
      summary: Test package.json & yarn.lock File
      description: >-
        Test for issues in yarn files.You can test your yarn packages for issues according to their manifest file & lockfile using this action. It takes a JSON object containing a "target" `package.json` and a `yarn.lock`.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testpackage.json&yarn.lockFile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/yarnrequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: '{ "name": "shallow-goof", "version": "0.0.1", "description": "A vulnerable demo application", "homepage": "https://snyk.io/", "repository": { "type": "git", "url": "https://github.com/Snyk/shallow-goof" }, "dependencies": { "node-uuid": "1.4.0", "qs": "0.0.6" } }'
                      additional:
                        - contents: '# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.\r\n# yarn lockfile v1\r\n\r\n\r\nnode-uuid@1.4.0:\r\n  version \"1.4.0\"\r\n  resolved \"https:\/\/registry.yarnpkg.com\/node-uuid\/-\/node-uuid-1.4.0.tgz#07f9b2337572ff6275c775e1d48513f3a45d7a65\"\r\n  integrity sha1-B\/myM3Vy\/2J1x3Xh1IUT86RdemU=\r\n\r\nqs@0.0.6:\r\n  version \"0.0.6\"\r\n  resolved \"https:\/\/registry.yarnpkg.com\/qs\/-\/qs-0.0.6.tgz#481659b7e5bf6a5ea898010de5aed35eb469e124\"\r\n  integrity sha1-SBZZt+W\/al6omAEN5a7TXrRp4SQ=\r\n'
            example:
              encoding: plain
              files:
                target:
                  contents: '{ "name": "shallow-goof", "version": "0.0.1", "description": "A vulnerable demo application", "homepage": "https://snyk.io/", "repository": { "type": "git", "url": "https://github.com/Snyk/shallow-goof" }, "dependencies": { "node-uuid": "1.4.0", "qs": "0.0.6" } }'
                additional:
                  - contents: '# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.\r\n# yarn lockfile v1\r\n\r\n\r\nnode-uuid@1.4.0:\r\n  version \"1.4.0\"\r\n  resolved \"https:\/\/registry.yarnpkg.com\/node-uuid\/-\/node-uuid-1.4.0.tgz#07f9b2337572ff6275c775e1d48513f3a45d7a65\"\r\n  integrity sha1-B\/myM3Vy\/2J1x3Xh1IUT86RdemU=\r\n\r\nqs@0.0.6:\r\n  version \"0.0.6\"\r\n  resolved \"https:\/\/registry.yarnpkg.com\/qs\/-\/qs-0.0.6.tgz#481659b7e5bf6a5ea898010de5aed35eb469e124\"\r\n  integrity sha1-SBZZt+W\/al6omAEN5a7TXrRp4SQ=\r\n'
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Testpackage.jsonyarn.lockFileresponse'
      deprecated: false
  /test/rubygems/{gemName}/{version}:
    get:
      tags:
        - Test
      summary: Test for issues in a public gem by name and version
      description: >-
        Test for issues in rubygems packages and applications.You can test `rubygems` packages for issues according to their name and version.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testforissuesinapublicgembynameandversion
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: gemName
          in: path
          description: The gem name.
          required: true
          style: simple
          schema:
            type: string
            example: rails-html-sanitizer
        - name: version
          in: path
          description: The gem version to test.
          required: true
          style: simple
          schema:
            type: string
            example: 1.0.3
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Testforissuesinapublicgembynameandversionresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-RUBY-RAILSHTMLSANITIZER-22025
                            url: https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-22025
                            title: Cross-site Scripting (XSS)
                            type: vuln
                            description: "## Overview\n[rails-html-sanitizer](https://github.com/rails/rails-html-sanitizer)\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS). The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications.\n\nThis issue is similar to [CVE-2018-8048](https://snyk.io/vuln/SNYK-RUBY-LOOFAH-22023) in Loofah.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `rails-html-sanitizer` to version 1.0.4 or higher.\n\n## References\n- [Ruby on Rails Security Google Forum](https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-3741)\n"
                            functions: []
                            from:
                              - rails-html-sanitizer@1.0.3
                            package: rails-html-sanitizer
                            version: 1.0.3
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: ruby
                            packageManager: rubygems
                            semver:
                              vulnerable:
                                - <1.0.4
                            publicationTime: 2018-03-27T07:42:10.777000Z
                            disclosureTime: 2018-03-22T21:46:15.453000Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-3741
                              CWE:
                                - CWE-79
                            credit:
                              - Kaarlo Haikonen
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
                            cvssScore: 6.1
                            patches: []
                            upgradePath:
                              - rails-html-sanitizer@1.0.4
                        licenses: []
                      dependencyCount: 5
                      org:
                        name: atokeneduser
                        id: 4a18d42f-0706-4ad0-b127-24078731fbed
                      licensesPolicy: null
                      packageManager: rubygems
      deprecated: false
  /test/rubygems:
    post:
      tags:
        - Test
      summary: Test gemfile.lock file
      description: >-
        Test for issues in rubygems packages and applications.You can test your rubygems applications for issues according to their lockfile using this action. It takes a JSON object containing a the "target" `Gemfile.lock`.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testgemfile.lockfile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/rubygemsrequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: 'GEM\n remote: http://rubygems.org/\n specs:\n actionpack (4.2.5)\n actionview (= 4.2.5)\n activesupport (= 4.2.5)\n rack (~> 1.6)\n rack-test (~> 0.6.2)\n rails-dom-testing (~> 1.0, >= 1.0.5)\n rails-html-sanitizer (~> 1.0, >= 1.0.2)\n actionview (4.2.5)\n activesupport (= 4.2.5)\n builder (~> 3.1)\n erubis (~> 2.7.0)\n rails-dom-testing (~> 1.0, >= 1.0.5)\n rails-html-sanitizer (~> 1.0, >= 1.0.2)\n activesupport (4.2.5)\n i18n (~> 0.7)\n json (~> 1.7, >= 1.7.7)\n minitest (~> 5.1)\n thread_safe (~> 0.3, >= 0.3.4)\n tzinfo (~> 1.1)\n builder (3.2.2)\n erubis (2.7.0)\n haml (3.1.4)\n httparty (0.8.1)\n multi_json\n multi_xml\n i18n (0.7.0)\n json (1.8.3)\n loofah (2.0.3)\n nokogiri (>= 1.5.9)\n mini_portile2 (2.1.0)\n minitest (5.9.1)\n multi_json (1.12.1)\n multi_xml (0.5.5)\n nokogiri (1.6.8.1)\n mini_portile2 (~> 2.1.0)\n rack (1.6.4)\n rack-protection (1.5.3)\n rack\n rack-test (0.6.3)\n rack (>= 1.0)\n rails-deprecated_sanitizer (1.0.3)\n activesupport (>= 4.2.0.alpha)\n rails-dom-testing (1.0.7)\n activesupport (>= 4.2.0.beta, < 5.0)\n nokogiri (~> 1.6.0)\n rails-deprecated_sanitizer (>= 1.0.1)\n rails-html-sanitizer (1.0.3)\n loofah (~> 2.0)\n sinatra (1.3.2)\n rack (~> 1.3, >= 1.3.6)\n rack-protection (~> 1.2)\n tilt (~> 1.3, >= 1.3.3)\n thread_safe (0.3.5)\n tilt (1.4.1)\n tzinfo (1.2.2)\n thread_safe (~> 0.1)\n \n PLATFORMS\n ruby\n \n DEPENDENCIES\n actionpack\n haml\n httparty\n sinatra\n \n BUNDLED WITH\n 1.13.2'
            example:
              encoding: plain
              files:
                target:
                  contents: 'GEM\n remote: http://rubygems.org/\n specs:\n actionpack (4.2.5)\n actionview (= 4.2.5)\n activesupport (= 4.2.5)\n rack (~> 1.6)\n rack-test (~> 0.6.2)\n rails-dom-testing (~> 1.0, >= 1.0.5)\n rails-html-sanitizer (~> 1.0, >= 1.0.2)\n actionview (4.2.5)\n activesupport (= 4.2.5)\n builder (~> 3.1)\n erubis (~> 2.7.0)\n rails-dom-testing (~> 1.0, >= 1.0.5)\n rails-html-sanitizer (~> 1.0, >= 1.0.2)\n activesupport (4.2.5)\n i18n (~> 0.7)\n json (~> 1.7, >= 1.7.7)\n minitest (~> 5.1)\n thread_safe (~> 0.3, >= 0.3.4)\n tzinfo (~> 1.1)\n builder (3.2.2)\n erubis (2.7.0)\n haml (3.1.4)\n httparty (0.8.1)\n multi_json\n multi_xml\n i18n (0.7.0)\n json (1.8.3)\n loofah (2.0.3)\n nokogiri (>= 1.5.9)\n mini_portile2 (2.1.0)\n minitest (5.9.1)\n multi_json (1.12.1)\n multi_xml (0.5.5)\n nokogiri (1.6.8.1)\n mini_portile2 (~> 2.1.0)\n rack (1.6.4)\n rack-protection (1.5.3)\n rack\n rack-test (0.6.3)\n rack (>= 1.0)\n rails-deprecated_sanitizer (1.0.3)\n activesupport (>= 4.2.0.alpha)\n rails-dom-testing (1.0.7)\n activesupport (>= 4.2.0.beta, < 5.0)\n nokogiri (~> 1.6.0)\n rails-deprecated_sanitizer (>= 1.0.1)\n rails-html-sanitizer (1.0.3)\n loofah (~> 2.0)\n sinatra (1.3.2)\n rack (~> 1.3, >= 1.3.6)\n rack-protection (~> 1.2)\n tilt (~> 1.3, >= 1.3.3)\n thread_safe (0.3.5)\n tilt (1.4.1)\n tzinfo (1.2.2)\n thread_safe (~> 0.1)\n \n PLATFORMS\n ruby\n \n DEPENDENCIES\n actionpack\n haml\n httparty\n sinatra\n \n BUNDLED WITH\n 1.13.2'
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Testgemfile.lockfileresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-RUBY-JSON-20000
                            url: https://snyk.io/vuln/SNYK-RUBY-JSON-20000
                            title: Denial of Service (DoS)
                            type: vuln
                            description: >
                              ## Overview


                              The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.

                              Affected versions of this Gem contain an overflow condition. This is triggered when user-supplied input is not properly validated while handling specially crafted data. This can allow a remote attacker to cause a stack-based buffer overflow, resulting in a denial of service, or potentially allowing the [execution of arbitrary code](https://snyk.io/vuln/SNYK-RUBY-JSON-20209).


                              ## Details

                              Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                              Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                              One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                              When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                              Two common types of DoS vulnerabilities:



                              * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                              * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                              ## References

                              - http://rubysec.com/advisories/OSVDB-101157
                            functions: []
                            from:
                              - json@1.0.0
                            package: json
                            version: 1.0.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: ruby
                            packageManager: rubygems
                            semver:
                              vulnerable:
                                - < 1.1.0
                            publicationTime: 2007-05-20T21:00:00Z
                            disclosureTime: 2007-05-20T21:00:00Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-400
                              OSVDB:
                                - OSVDB-101157
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                            cvssScore: 7.5
                            patches: []
                            upgradePath:
                              - json@1.1.0
                          - id: SNYK-RUBY-JSON-20060
                            url: https://snyk.io/vuln/SNYK-RUBY-JSON-20060
                            title: Denial of Service (DoS)
                            type: vuln
                            description: >
                              ## Overview

                              The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.

                              Affected versions of this Gem are vulnerable to Denial of Service (DoS) attacks and unsafe object creation vulnerabilities. When parsing certain JSON documents, the JSON gem tricked into creating Ruby symbols in a target system.


                              ## Details


                              When parsing certain JSON documents, the JSON gem can be coerced in to creating Ruby symbols in a target system.  Since Ruby symbols are not garbage collected, this can result in a denial of service attack.


                              The same technique can be used to create objects in a target system that act like internal objects.  These "act alike" objects can be used to bypass certain security mechanisms and can be used as a spring board for SQL injection attacks in Ruby on Rails.


                              Impacted code looks like this:

                              ```js

                              JSON.parse(user_input)

                              ```

                              Where the `user_input` variable will have a JSON document like this:

                              ```json

                              {"json_class":"foo"}

                              ```

                              The JSON gem will attempt to look up the constant "foo".  Looking up this constant will create a symbol.


                              In JSON version 1.7.x, objects with arbitrary attributes can be created using JSON documents like this:

                              ```json

                              {"json_class":"JSON::GenericObject","foo":"bar"}

                              ```

                              This document will result in an instance of `JSON::GenericObject`, with the attribute "foo" that has the value "bar".  Instantiating these objects will result in arbitrary symbol creation and in some cases can be used to bypass security measures.


                              PLEASE NOTE: this behavior *does not change* when using `JSON.load`.  `JSON.load` should *never* be given input from unknown sources.  If you are processing JSON from an unknown source, *always* use `JSON.parse`.


                              ## References

                              - https://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/

                              - https://gist.github.com/rsierra/4943505
                            functions: []
                            from:
                              - json@1.0.0
                            package: json
                            version: 1.0.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: ruby
                            packageManager: rubygems
                            semver:
                              vulnerable:
                                - < 1.7.7, >= 1.7
                                - < 1.6.8, >= 1.6
                                - < 1.5.5
                            publicationTime: 2013-02-10T22:00:00Z
                            disclosureTime: 2013-02-10T22:00:00Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2013-0269
                              CWE:
                                - CWE-400
                              OSVDB:
                                - OSVDB-90074
                            credit:
                              - Thomas Hollstegge
                              - Ben Murphy
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
                            cvssScore: 7.3
                            patches: []
                            upgradePath:
                              - json@1.5.5
                          - id: SNYK-RUBY-JSON-20209
                            url: https://snyk.io/vuln/SNYK-RUBY-JSON-20209
                            title: Arbitrary Code Execution
                            type: vuln
                            description: >
                              ## Overview


                              The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.


                              Affected versions of this Gem contain an overflow condition. This is triggered when user-supplied input is not properly validated while handling specially crafted data. This can allow a remote attacker to cause a stack-based buffer overflow, resulting in a [denial of service](https://snyk.io/vuln/SNYK-RUBY-JSON-20000), or potentially allowing the execution of arbitrary code.


                              ## References


                              - http://rubysec.com/advisories/OSVDB-101157
                            functions: []
                            from:
                              - json@1.0.0
                            package: json
                            version: 1.0.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: ruby
                            packageManager: rubygems
                            semver:
                              vulnerable:
                                - < 1.1.0
                            publicationTime: 2007-05-20T21:00:00Z
                            disclosureTime: 2007-05-20T21:00:00Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-94
                              OSVDB:
                                - OSVDB-101157-1
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
                            cvssScore: 7.5
                            patches: []
                            upgradePath:
                              - json@1.1.0
                          - id: SNYK-RUBY-RACK-538324
                            url: https://snyk.io/vuln/SNYK-RUBY-RACK-538324
                            title: Information Exposure
                            type: vuln
                            description: >
                              ## Overview


                              [rack](https://rack.github.io/) is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.



                              Affected versions of this package are vulnerable to Information Exposure.

                              Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.


                              ## Remediation


                              Upgrade `rack` to version 1.6.12, 2.0.8 or higher.



                              ## References


                              - [GitHub Fix Commit](https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38)


                              - [GitHub Security Advisory](https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3)
                            functions: []
                            from:
                              - redis-rack-cache@1.1
                              - rack-cache@1.1
                              - rack@2.0.1
                            package: rack
                            version: 2.0.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: ruby
                            packageManager: rubygems
                            semver:
                              vulnerable:
                                - <1.6.12
                                - '>=2.0.0.alpha, <2.0.8'
                            publicationTime: 2019-12-19T20:24:49Z
                            disclosureTime: 2019-12-18T20:24:49Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2019-16782
                              CWE:
                                - CWE-200
                            credit:
                              - Will Leinweber
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 5.3
                            patches: []
                            upgradePath:
                              - redis-rack-cache@1.1
                              - rack-cache@1.1
                              - rack@2.0.8
                          - id: SNYK-RUBY-RACK-72567
                            url: https://snyk.io/vuln/SNYK-RUBY-RACK-72567
                            title: Cross-site Scripting (XSS)
                            type: vuln
                            description: >
                              ## Overview


                              [rack](https://rack.github.io/) is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.



                              Affected versions of this package are vulnerable to Cross-site Scripting (XSS)

                              via the `scheme` method on `Rack::Request`.


                              ## Remediation


                              Upgrade `rack` to version 1.6.11, 2.0.6 or higher.



                              ## References


                              - [GitHub Commit](https://github.com/rack/rack/commit/313dd6a05a5924ed6c82072299c53fed09e39ae7)


                              - [Google Security Forum](https://groups.google.com/forum/#!msg/rubyonrails-security/GKsAFT924Ag/DYtk-Xl6AAAJ)


                              - [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1646818)
                            functions: []
                            from:
                              - redis-rack-cache@1.1
                              - rack-cache@1.1
                              - rack@2.0.1
                            package: rack
                            version: 2.0.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: ruby
                            packageManager: rubygems
                            semver:
                              vulnerable:
                                - <1.6.11
                                - '>=2.0.0, <2.0.6'
                            publicationTime: 2018-11-06T16:08:37Z
                            disclosureTime: 2018-08-22T15:56:49Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-16470
                              CWE:
                                - CWE-79
                            credit:
                              - Aaron Patterson
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
                            cvssScore: 6.1
                            patches: []
                            upgradePath:
                              - redis-rack-cache@1.1
                              - rack-cache@1.1
                              - rack@2.0.6
                          - id: SNYK-RUBY-RACKCACHE-20031
                            url: https://snyk.io/vuln/SNYK-RUBY-RACKCACHE-20031
                            title: HTTP Header Caching Weakness
                            type: vuln
                            description: >
                              ## Overview

                              [rack-cache](https://rubygems.org/gems/rack-cache) enables HTTP caching for Rack-based applications.

                              Affected versions of this gem contain a flaw related to the rubygem caching sensitive HTTP headers. This will result in a weakness that may make it easier for an attacker to gain access to a user's session via a specially crafted header.


                              ## References

                              - http://rubysec.com/advisories/CVE-2012-2671
                            functions: []
                            from:
                              - redis-rack-cache@1.1
                              - rack-cache@1.1
                            package: rack-cache
                            version: '1.1'
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: ruby
                            packageManager: rubygems
                            semver:
                              vulnerable:
                                - < 1.2
                            publicationTime: 2012-06-05T21:00:00Z
                            disclosureTime: 2012-06-05T21:00:00Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2012-2671
                              CWE:
                                - CWE-444
                              OSVDB:
                                - OSVDB-83077
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
                            cvssScore: 7.3
                            patches: []
                            upgradePath:
                              - redis-rack-cache@1.2
                              - rack-cache@1.2
                          - id: SNYK-RUBY-REDISSTORE-20452
                            url: https://snyk.io/vuln/SNYK-RUBY-REDISSTORE-20452
                            title: Deserialization of Untrusted Data
                            type: vuln
                            description: >
                              ## Overview

                              [`redis-store`](https://rubygems.org/gems/redis-store) is a namespaced Rack::Session, Rack::Cache, I18n and cache Redis stores for Ruby web frameworks.


                              Affected versions of the package are vulnerable to Deserialization of Untrusted Data.


                              # Details

                              Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.


                              _Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.


                              An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.


                              ## Remediation

                              Upgrade `redis-store` to version 1.4.0 or higher.


                              ## References

                              - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-1000248)

                              - [GitHub PR](https://github.com/redis-store/redis-store/pull/290)

                              - [GitHub Issue](https://github.com/redis-store/redis-store/issues/289)

                              - [GitHub Commit](https://github.com/redis-store/redis-store/commit/e0c1398d54a9661c8c70267c3a925ba6b192142e)
                            functions: []
                            from:
                              - redis-rack-cache@1.1
                              - redis-store@1.1.0
                            package: redis-store
                            version: 1.1.0
                            severity: critical
                            exploitMaturity: no-known-exploit
                            language: ruby
                            packageManager: rubygems
                            semver:
                              vulnerable:
                                - <1.4.0
                            publicationTime: 2017-12-07T09:52:33.659000Z
                            disclosureTime: 2017-08-10T21:00:00Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2017-1000248
                              CWE:
                                - CWE-502
                            credit:
                              - Dylan Katz
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 9.8
                            patches: []
                            upgradePath:
                              - redis-rack-cache@2.0.2
                              - redis-store@1.4.0
                        licenses: []
                      dependencyCount: 6
                      org:
                        name: atokeneduser
                        id: 4a18d42f-0706-4ad0-b127-24078731fbed
                      licensesPolicy: null
                      packageManager: rubygems
      deprecated: false
  /test/gradle/{group}/{name}/{version}:
    get:
      tags:
        - Test
      summary: Test for issues in a public package by group, name and version
      description: >-
        Test for issues in Gradle files.You can test `gradle` packages for issues according to their group, name and version. This is done via the maven endpoint (for Java), since the packages are hosted on maven central or a compatible repository. See "Maven" above for details.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testforissuesinapublicpackagebygroup,nameandversion
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
        - name: repository
          in: query
          description: The repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
          style: form
          explode: true
          schema:
            type: string
            example: https://repo1.maven.org/maven2
        - name: group
          in: path
          description: The package's group ID.
          required: true
          style: simple
          schema:
            type: string
            example: org.apache.flex.blazeds
        - name: name
          in: path
          description: The package's artifact ID.
          required: true
          style: simple
          schema:
            type: string
            example: blazeds
        - name: version
          in: path
          description: The package version to test.
          required: true
          style: simple
          schema:
            type: string
            example: 4.7.2
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Testforissuesinapublicpackagebygroupnameandversionresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
                            url: https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
                            title: Arbitrary Code Execution
                            type: vuln
                            description: >
                              ## Overview


                              [org.apache.flex.blazeds:blazeds](https://github.com/apache/flex-blazeds) is an application development framework for easily building Flash-based applications for mobile devices, web browsers, and desktops.



                              Affected versions of this package are vulnerable to Arbitrary Code Execution.

                              The AMF deserialization implementation of Flex BlazeDS is vulnerable to Deserialization of Untrusted Data. By sending a specially crafted AMF message, it is possible to make the server establish a connection to an endpoint specified in the message and request an RMI remote object from that endpoint. This can result in the execution of arbitrary code on the server via Java deserialization.



                              Starting with BlazeDS version `4.7.3`, Deserialization of XML is disabled completely per default, while the `ClassDeserializationValidator` allows deserialization of whitelisted classes only. BlazeDS internally comes with the following whitelist:

                              ```

                              flex.messaging.io.amf.ASObject

                              flex.messaging.io.amf.SerializedObject

                              flex.messaging.io.ArrayCollection

                              flex.messaging.io.ArrayList

                              flex.messaging.messages.AcknowledgeMessage

                              flex.messaging.messages.AcknowledgeMessageExt

                              flex.messaging.messages.AsyncMessage

                              flex.messaging.messages.AsyncMessageExt

                              flex.messaging.messages.CommandMessage

                              flex.messaging.messages.CommandMessageExt

                              flex.messaging.messages.ErrorMessage

                              flex.messaging.messages.HTTPMessage

                              flex.messaging.messages.RemotingMessage

                              flex.messaging.messages.SOAPMessage

                              java.lang.Boolean

                              java.lang.Byte

                              java.lang.Character

                              java.lang.Double

                              java.lang.Float

                              java.lang.Integer

                              java.lang.Long

                              java.lang.Object

                              java.lang.Short

                              java.lang.String

                              java.util.ArrayList

                              java.util.Date

                              java.util.HashMap

                              org.w3c.dom.Document

                              ```


                              ## Remediation


                              Upgrade `org.apache.flex.blazeds:blazeds` to version 4.7.3 or higher.



                              ## References


                              - [CVE-2017-3066](https://nvd.nist.gov/vuln/detail/CVE-2017-5641)


                              - [Github Commit](https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1)


                              - [Github Release Notes](https://github.com/apache/flex-blazeds/blob/master/RELEASE_NOTES)


                              - [Securitytracker Issue](http://www.securitytracker.com/id/1038364)
                            functions: []
                            from:
                              - org.apache.flex.blazeds:blazeds@4.7.2
                            package: org.apache.flex.blazeds:blazeds
                            version: 4.7.2
                            severity: critical
                            exploitMaturity: no-known-exploit
                            language: java
                            packageManager: maven
                            semver:
                              vulnerable:
                                - '[,4.7.3)'
                            publicationTime: 2017-08-09T14:17:08Z
                            disclosureTime: 2017-04-25T21:00:00Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2017-5641
                              CWE:
                                - CWE-502
                            credit:
                              - Markus Wulftange
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 9.8
                            patches: []
                            upgradePath:
                              - org.apache.flex.blazeds:blazeds@4.7.3
                        licenses: []
                      dependencyCount: 1
                      org:
                        name: atokeneduser
                        id: 689ce7f9-7943-4a71-b704-2ba575f01089
                      licensesPolicy: null
                      packageManager: maven
      deprecated: false
  /test/gradle:
    post:
      tags:
        - Test
      summary: Test gradle file
      description: >-
        Test for issues in Gradle files.You can test your Gradle packages for issues according to their manifest file using this action. It takes a JSON object containing the "target" `build.gradle`.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testgradlefile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
        - name: repository
          in: query
          description: The repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
          style: form
          explode: true
          schema:
            type: string
            example: https://repo1.maven.org/maven2
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Gradlerequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: dependencies { compile 'axis:axis:1.4' }
            example:
              encoding: plain
              files:
                target:
                  contents: dependencies { compile 'axis:axis:1.4' }
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Testgradlefileresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-JAVA-AXIS-30071
                            url: https://snyk.io/vuln/SNYK-JAVA-AXIS-30071
                            title: Man-in-the-Middle (MitM)
                            type: vuln
                            description: "## Overview\n\n[axis:axis](https://search.maven.org/search?q=g:axis) is an implementation of the SOAP (\"Simple Object Access Protocol\") submission to W3C.\n\n\nAffected versions of this package are vulnerable to Man-in-the-Middle (MitM).\nIt does not verify the requesting server's hostname against existing domain names in the SSL Certificate. \r\n\r\n## Details\r\nThe `getCN` function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's `Common Name (CN)` or `subjectAltName` field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  \r\n\r\n**NOTE:** this issue exists because of an incomplete fix for [CVE-2012-5784](https://snyk.io/vuln/SNYK-JAVA-AXIS-30189).\n\n## Remediation\n\nThere is no fixed version for `axis:axis`.\n\n\n## References\n\n- [Axis Issue](https://issues.apache.org/jira/browse/AXIS-2905)\n\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3596)\n\n- [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3596)\n"
                            functions: []
                            from:
                              - axis:axis@1.4
                            package: axis:axis
                            version: '1.4'
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: java
                            packageManager: maven
                            semver:
                              vulnerable:
                                - '[0,]'
                            publicationTime: 2014-08-18T16:51:53Z
                            disclosureTime: 2014-08-18T16:51:53Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2014-3596
                              CWE:
                                - CWE-297
                            credit:
                              - David Jorm
                              - Arun Neelicattu
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
                            cvssScore: 5.4
                            patches: []
                            upgradePath: []
                          - id: SNYK-JAVA-AXIS-30189
                            url: https://snyk.io/vuln/SNYK-JAVA-AXIS-30189
                            title: Man-in-the-Middle (MitM)
                            type: vuln
                            description: >
                              ## Overview


                              [axis:axis](https://search.maven.org/search?q=g:axis) is an implementation of the SOAP ("Simple Object Access Protocol") submission to W3C.



                              Affected versions of this package are vulnerable to Man-in-the-Middle (MitM).

                              It does not verify the requesting server's hostname against existing domain names in the SSL Certificate.



                              ## Details

                              Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's `Common Name (CN)` or `subjectAltName` field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


                              ## Remediation


                              There is no fixed version for `axis:axis`.



                              ## References


                              - [Jira Issue](https://issues.apache.org/jira/browse/AXIS-2883)


                              - [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5784)


                              - [Texas University](http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf)
                            functions: []
                            from:
                              - axis:axis@1.4
                            package: axis:axis
                            version: '1.4'
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: java
                            packageManager: maven
                            semver:
                              vulnerable:
                                - '[0,]'
                            publicationTime: 2017-03-13T08:00:21Z
                            disclosureTime: 2012-11-04T22:55:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2012-5784
                              CWE:
                                - CWE-20
                            credit:
                              - Alberto Fernández
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
                            cvssScore: 5.4
                            patches: []
                            upgradePath: []
                        licenses: []
                      dependencyCount: 6
                      org:
                        name: atokeneduser
                        id: 4a18d42f-0706-4ad0-b127-24078731fbed
                      licensesPolicy: null
                      packageManager: gradle
      deprecated: false
  /test/sbt/{groupId}/{artifactId}/{version}:
    get:
      tags:
        - Test
      summary: sbt_Test for issues in a public package by group id, artifact id and version
      description: >-
        Test for issues in sbt files.You can test `sbt` packages for issues according to their group ID, artifact ID and version. This is done via the maven endpoint (for Java), since the packages are hosted on maven central or a compatible repository. See "Maven" above for details.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: sbt_Testforissuesinapublicpackagebygroupid,artifactidandversion
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
        - name: repository
          in: query
          description: The repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
          style: form
          explode: true
          schema:
            type: string
            example: https://repo1.maven.org/maven2
        - name: groupId
          in: path
          description: The package's group ID.
          required: true
          style: simple
          schema:
            type: string
            example: org.apache.flex.blazeds
        - name: artifactId
          in: path
          description: The package's artifact ID.
          required: true
          style: simple
          schema:
            type: string
            example: blazeds
        - name: version
          in: path
          description: The package version to test.
          required: true
          style: simple
          schema:
            type: string
            example: 4.7.2
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/sbt_Testforissuesinapublicpackagebygroupidartifactidandversionresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
                            url: https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
                            title: Arbitrary Code Execution
                            type: vuln
                            description: >
                              ## Overview


                              [org.apache.flex.blazeds:blazeds](https://github.com/apache/flex-blazeds) is an application development framework for easily building Flash-based applications for mobile devices, web browsers, and desktops.



                              Affected versions of this package are vulnerable to Arbitrary Code Execution.

                              The AMF deserialization implementation of Flex BlazeDS is vulnerable to Deserialization of Untrusted Data. By sending a specially crafted AMF message, it is possible to make the server establish a connection to an endpoint specified in the message and request an RMI remote object from that endpoint. This can result in the execution of arbitrary code on the server via Java deserialization.



                              Starting with BlazeDS version `4.7.3`, Deserialization of XML is disabled completely per default, while the `ClassDeserializationValidator` allows deserialization of whitelisted classes only. BlazeDS internally comes with the following whitelist:

                              ```

                              flex.messaging.io.amf.ASObject

                              flex.messaging.io.amf.SerializedObject

                              flex.messaging.io.ArrayCollection

                              flex.messaging.io.ArrayList

                              flex.messaging.messages.AcknowledgeMessage

                              flex.messaging.messages.AcknowledgeMessageExt

                              flex.messaging.messages.AsyncMessage

                              flex.messaging.messages.AsyncMessageExt

                              flex.messaging.messages.CommandMessage

                              flex.messaging.messages.CommandMessageExt

                              flex.messaging.messages.ErrorMessage

                              flex.messaging.messages.HTTPMessage

                              flex.messaging.messages.RemotingMessage

                              flex.messaging.messages.SOAPMessage

                              java.lang.Boolean

                              java.lang.Byte

                              java.lang.Character

                              java.lang.Double

                              java.lang.Float

                              java.lang.Integer

                              java.lang.Long

                              java.lang.Object

                              java.lang.Short

                              java.lang.String

                              java.util.ArrayList

                              java.util.Date

                              java.util.HashMap

                              org.w3c.dom.Document

                              ```


                              ## Remediation


                              Upgrade `org.apache.flex.blazeds:blazeds` to version 4.7.3 or higher.



                              ## References


                              - [CVE-2017-3066](https://nvd.nist.gov/vuln/detail/CVE-2017-5641)


                              - [Github Commit](https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1)


                              - [Github Release Notes](https://github.com/apache/flex-blazeds/blob/master/RELEASE_NOTES)


                              - [Securitytracker Issue](http://www.securitytracker.com/id/1038364)
                            functions: []
                            from:
                              - org.apache.flex.blazeds:blazeds@4.7.2
                            package: org.apache.flex.blazeds:blazeds
                            version: 4.7.2
                            severity: critical
                            exploitMaturity: no-known-exploit
                            language: java
                            packageManager: maven
                            semver:
                              vulnerable:
                                - '[,4.7.3)'
                            publicationTime: 2017-08-09T14:17:08Z
                            disclosureTime: 2017-04-25T21:00:00Z
                            isUpgradable: true
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2017-5641
                              CWE:
                                - CWE-502
                            credit:
                              - Markus Wulftange
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 9.8
                            patches: []
                            upgradePath:
                              - org.apache.flex.blazeds:blazeds@4.7.3
                        licenses: []
                      dependencyCount: 1
                      org:
                        name: atokeneduser
                        id: 689ce7f9-7943-4a71-b704-2ba575f01089
                      licensesPolicy: null
                      packageManager: maven
      deprecated: false
  /test/sbt:
    post:
      tags:
        - Test
      summary: Test sbt file
      description: >-
        Test for issues in sbt files.You can test your `sbt` packages for issues according to their manifest file using this action. It takes a JSON object containing a the "target" `build.sbt`.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testsbtfile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
        - name: repository
          in: query
          description: The repository hosting this package. The default value is Maven Central. More than one value is supported, in order.
          style: form
          explode: true
          schema:
            type: string
            example: https://repo1.maven.org/maven2
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/sbtrequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: '\nname := \"subsearch\"\n\nassemblyJarName in assembly := s\"subsearch-0.2.0.jar\"\n\nscalaVersion := \"2.11.8\"\n\nscalacOptions ++= Seq(\"-unchecked\", \"-deprecation\")\n\nresolvers += Resolver.sonatypeRepo(\"public\")\n\nlibraryDependencies += \"org.scalatest\" % \"scalatest_2.11\" % \"2.2.1\" % \"test\"\nlibraryDependencies += \"org.scalamock\" %% \"scalamock-scalatest-support\" % \"3.2.2\" % \"test\"\nlibraryDependencies += \"net.databinder.dispatch\" %% \"dispatch-core\" % \"0.11.2\"\nlibraryDependencies += \"org.slf4j\" % \"slf4j-simple\" % \"1.6.6\"\nlibraryDependencies += \"com.github.scopt\" %% \"scopt\" % \"3.4.0\"\nlibraryDependencies += \"pl.project13.scala\" %% \"rainbow\" % \"0.2\"\nlibraryDependencies += \"dnsjava\" % \"dnsjava\" % \"2.1.7\"\nlibraryDependencies += \"com.typesafe.akka\" %% \"akka-actor\" % \"2.4.1\"\nlibraryDependencies += \"org.scala-lang.modules\" % \"scala-jline\" % \"2.12.1\"\nlibraryDependencies += \"net.ruippeixotog\" %% \"scala-scraper\" % \"1.0.0\"'
            example:
              encoding: plain
              files:
                target:
                  contents: '\nname := \"subsearch\"\n\nassemblyJarName in assembly := s\"subsearch-0.2.0.jar\"\n\nscalaVersion := \"2.11.8\"\n\nscalacOptions ++= Seq(\"-unchecked\", \"-deprecation\")\n\nresolvers += Resolver.sonatypeRepo(\"public\")\n\nlibraryDependencies += \"org.scalatest\" % \"scalatest_2.11\" % \"2.2.1\" % \"test\"\nlibraryDependencies += \"org.scalamock\" %% \"scalamock-scalatest-support\" % \"3.2.2\" % \"test\"\nlibraryDependencies += \"net.databinder.dispatch\" %% \"dispatch-core\" % \"0.11.2\"\nlibraryDependencies += \"org.slf4j\" % \"slf4j-simple\" % \"1.6.6\"\nlibraryDependencies += \"com.github.scopt\" %% \"scopt\" % \"3.4.0\"\nlibraryDependencies += \"pl.project13.scala\" %% \"rainbow\" % \"0.2\"\nlibraryDependencies += \"dnsjava\" % \"dnsjava\" % \"2.1.7\"\nlibraryDependencies += \"com.typesafe.akka\" %% \"akka-actor\" % \"2.4.1\"\nlibraryDependencies += \"org.scala-lang.modules\" % \"scala-jline\" % \"2.12.1\"\nlibraryDependencies += \"net.ruippeixotog\" %% \"scala-scraper\" % \"1.0.0\"'
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Testsbtfileresponse'
      deprecated: false
  /test/pip/{packageName}/{version}:
    get:
      tags:
        - Test
      summary: pip_Test for issues in a public package by name and version
      description: >-
        Test for issues in pip files.You can test `pip` packages for issues according to their name and version.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: pip_Testforissuesinapublicpackagebynameandversion
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
        - name: packageName
          in: path
          description: The package name.
          required: true
          style: simple
          schema:
            type: string
            example: rsa
        - name: version
          in: path
          description: The Package version to test.
          required: true
          style: simple
          schema:
            type: string
            example: '3.3'
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/pip_Testforissuesinapublicpackagebynameandversionresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-PYTHON-RSA-40541
                            url: https://snyk.io/vuln/SNYK-PYTHON-RSA-40541
                            title: Timing Attack
                            type: vuln
                            description: >
                              ## Overview

                              [`rsa`](https://pypi.python.org/pypi/rsa) is a Pure-Python RSA implementation.


                              Affected versions of this package are vulnerable to Timing attacks.


                              ## References

                              - [GitHub Issue](https://github.com/sybrenstuvel/python-rsa/issues/19)

                              - [GitHub Commit](https://github.com/sybrenstuvel/python-rsa/commit/2310b34bdb530e0bad793d42f589c9f848ff181b)
                            functions: []
                            from:
                              - rsa@3.3
                            package: rsa
                            version: '3.3'
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: python
                            packageManager: pip
                            semver:
                              vulnerable:
                                - '[3.0,3.4.0)'
                            publicationTime: 2013-11-15T02:34:45.265000Z
                            disclosureTime: 2013-11-15T02:34:45.265000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: true
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-208
                            credit:
                              - Manuel Aude Morales
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 5.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PYTHON-RSA-40542
                            url: https://snyk.io/vuln/SNYK-PYTHON-RSA-40542
                            title: Authentication Bypass
                            type: vuln
                            description: >
                              ## Overview

                              [`rsa`](https://pypi.python.org/pypi/rsa) is a Pure-Python RSA implementation.


                              Affected versions of this package are vulnerable to Authentication Bypass due to not implementing authentication encryption or use MACs to validate messages before decrypting public key encrypted messages.


                              ## References

                              - [GitHub Issue](https://github.com/sybrenstuvel/python-rsa/issues/13)

                              - [GitHub Commit](https://github.com/sybrenstuvel/python-rsa/commit/1681a0b2f84a4a252c71b87de870a2816de06fdf)
                            functions: []
                            from:
                              - rsa@3.3
                            package: rsa
                            version: '3.3'
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: python
                            packageManager: pip
                            semver:
                              vulnerable:
                                - '[3.0,3.4)'
                            publicationTime: 2012-12-07T03:15:00.052000Z
                            disclosureTime: 2012-12-07T03:15:00.052000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: true
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-287
                            credit:
                              - Sergio Lerner
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
                            cvssScore: 7.5
                            patches: []
                            upgradePath: []
                        licenses: []
                      dependencyCount: 2
                      org:
                        name: gitphill
                        id: 229b76f3-802c-4553-aa1d-01d4d86f7f61
                      licensesPolicy: null
                      packageManager: pip
      deprecated: false
  /test/pip:
    post:
      tags:
        - Test
      summary: Test requirements.txt file
      description: >-
        Test for issues in pip files.You can test your pip packages for issues according to their manifest file using this action. It takes a JSON object containing a the "target" `requirements.txt`.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testrequirements.txtfile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/piprequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: supervisor==3.1\noauth2==1.5.211
            example:
              encoding: plain
              files:
                target:
                  contents: supervisor==3.1\noauth2==1.5.211
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Testrequirements.txtfileresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-PYTHON-OAUTH2-40013
                            url: https://snyk.io/vuln/SNYK-PYTHON-OAUTH2-40013
                            title: Replay Attack
                            type: vuln
                            description: >+
                              ## Overview

                              [`oauth2`](https://pypi.python.org/pypi/oauth2) is a library for OAuth version 1.9

                              The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.



                              ## Remediation

                              Upgrade to version `1.9rc1` or greater.



                              ## References

                              - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-4346)

                              - [Bugzilla redhat](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4346)

                              - [GitHub Issue](https://github.com/simplegeo/python-oauth2/issues/129)

                            functions: []
                            from:
                              - oauth2@1.5.211
                            package: oauth2
                            version: 1.5.211
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: python
                            packageManager: pip
                            semver:
                              vulnerable:
                                - '[,1.9rc1)'
                            publicationTime: 2013-02-05T12:31:58Z
                            disclosureTime: 2013-02-05T12:31:58Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: true
                            identifiers:
                              CVE:
                                - CVE-2013-4346
                              CWE:
                                - CWE-310
                            credit:
                              - André Cruz
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
                            cvssScore: 4.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PYTHON-OAUTH2-40014
                            url: https://snyk.io/vuln/SNYK-PYTHON-OAUTH2-40014
                            title: Insecure Randomness
                            type: vuln
                            description: >+
                              ## Overview

                              [`oauth2`](https://pypi.python.org/pypi/oauth2) is a library for OAuth version 1.9



                              Affected versions of this package are vulnerable to Insecure Randomness.

                              The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.



                              ## Remediation

                              Upgrade to version `1.9rc1` or greater.



                              ## References

                              - [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4347)

                              - [GitHub Issue](https://github.com/simplegeo/python-oauth2/issues/9)

                              - [Openwall](http://www.openwall.com/lists/oss-security/2013/09/12/7)

                              - [GitHub PR](https://github.com/simplegeo/python-oauth2/pull/146)

                            functions: []
                            from:
                              - oauth2@1.5.211
                            package: oauth2
                            version: 1.5.211
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: python
                            packageManager: pip
                            semver:
                              vulnerable:
                                - '[,1.9rc1)'
                            publicationTime: 2017-04-13T12:31:58Z
                            disclosureTime: 2014-05-20T14:55:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: true
                            identifiers:
                              CVE:
                                - CVE-2013-4347
                              CWE:
                                - CWE-310
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
                            cvssScore: 5.4
                            patches: []
                            upgradePath: []
                          - id: SNYK-PYTHON-SUPERVISOR-40610
                            url: https://snyk.io/vuln/SNYK-PYTHON-SUPERVISOR-40610
                            title: Arbitrary Command Execution
                            type: vuln
                            description: >-
                              ## Overview

                              [`supervisor`](https://pypi.python.org/pypi/supervisor/) is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating systems.



                              Affected versions of the package are vulnerable to Arbitrary Command Execution. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to `supervisord` that will run arbitrary shell commands on the server. The commands will be run as the same user as `supervisord`. Depending on how `supervisord` has been configured, this may be root.



                              ## Details

                              * `supervisord` is the server component and is responsible for starting child processes, responding to commands from clients, and other commands.

                              * `supervisorctl` is the command line component, providing a shell-like interface to the features provided by `supervisord`.



                              `supervisord` can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. This HTTP server is how `supervisorctl` communicates with `supervisord`. If an HTTP server has been enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to `supervisord` that will run arbitrary shell commands on the server. The commands will be run as the same user as `supervisord`. Depending on how `supervisord` has been configured, this may be root.

                              This vulnerability can only be exploited by an authenticated client or if `supervisord` has been configured to run an HTTP server without authentication. If authentication has not been enabled, `supervisord` will log a message at the critical level every time it starts.



                              ## PoC by Maor Shwartz



                              Create a config file `supervisord.conf`:



                              ```conf

                              [supervisord]

                              loglevel = trace



                              [inet_http_server]

                              port = 127.0.0.1:9001



                              [rpcinterface:supervisor]

                              supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

                              ```



                              Start supervisord in the foreground with that config file:



                              ```

                              $ supervisord -n -c supervisord.conf

                              ```



                              In a new terminal:



                              ```py

                              $ python2

                              >>> from xmlrpclib import ServerProxy

                              >>> server = ServerProxy('http://127.0.0.1:9001/RPC2')

                              >>> server.supervisor.supervisord.options.execve('/bin/sh', [], {})

                                ```



                              If the `supervisord` version is vulnerable, the `execve` will be executed and the `supervisord` process will be replaced with /bin/sh (or any other command given). If the `supervisord` version is not vulnerable, it will return an `UNKNOWN_METHOD` fault.





                              ## Remediation

                              Upgrade `supervisor` to version 3.3.3 or higher.



                              ## References

                              - [Github Issue](https://github.com/Supervisor/supervisor/issues/964)

                              - [Github Commit 3.0.1](https://github.com/Supervisor/supervisor/commit/83060f3383ebd26add094398174f1de34cf7b7f0)

                              - [Github Commit 3.1.4](https://github.com/Supervisor/supervisor/commit/dbe0f55871a122eac75760aef511efc3a8830b88)

                              - [Github Commit 3.2.4](https://github.com/Supervisor/supervisor/commit/aac3c21893cab7361f5c35c8e20341b298f6462e)

                              - [Github Commit 3.3.3](https://github.com/Supervisor/supervisor/commit/058f46141e346b18dee0497ba11203cb81ecb19e)
                            functions: []
                            from:
                              - supervisor@3.1.0
                            package: supervisor
                            version: 3.1.0
                            severity: high
                            exploitMaturity: mature
                            language: python
                            packageManager: pip
                            semver:
                              vulnerable:
                                - '[3.0a1,3.0.1)'
                                - '[3.1.0,3.1.4)'
                                - '[3.2.0,3.2.4)'
                                - '[3.3.0,3.3.3)'
                            publicationTime: 2017-08-08T06:59:14Z
                            disclosureTime: 2017-07-18T21:00:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: true
                            identifiers:
                              CVE:
                                - CVE-2017-11610
                              CWE:
                                - CWE-94
                            credit:
                              - Maor Shwartz
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
                            cvssScore: 8.8
                            patches: []
                            upgradePath: []
                        licenses: []
                      dependencyCount: 4
                      org:
                        name: atokeneduser
                        id: 4a18d42f-0706-4ad0-b127-24078731fbed
                      licensesPolicy: null
                      packageManager: pip
      deprecated: false
  /test/composer:
    post:
      tags:
        - Test
      summary: Test composer.json & composer.lock file
      description: >-
        Test for issues in PHP composer.json and composer.lock files.You can test your Composer packages for issues according to their manifest file & lockfile using this action. It takes a JSON object containing a "target" `composer.json` and a `composer.lock`.


        #### Required permissions


        - `View Organization`


        - `Test Packages`
      operationId: Testcomposer.json&composer.lockfile
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/composerrequestpayload'
                - example:
                    encoding: plain
                    files:
                      target:
                        contents: '{"name": "vulnerable/project","description": "A sample vulnerable project","require": {"php": ">=5.3.2","symfony/symfony": "v2.3.1","yiisoft/yii": "1.1.14","zendframework/zendframework": "2.1.0","aws/aws-sdk-php": "3.0.0","doctrine/common": "2.5.0"}}'
                      additional:
                        - contents: '{"_readme":["This file locks the dependencies of your project to a known state","Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file","This file is @generated automatically"],"content-hash":"3a3771e545494c4c098e639bd68602ba","packages":[{"name":"aws/aws-sdk-php","version":"3.0.0","source":{"type":"git","url":"https://github.com/aws/aws-sdk-php.git","reference":"4018c8f14a9e53003bb0417fa859c6a7ad57b53b"},"dist":{"type":"zip","url":"https://api.github.com/repos/aws/aws-sdk-php/zipball/4018c8f14a9e53003bb0417fa859c6a7ad57b53b","reference":"4018c8f14a9e53003bb0417fa859c6a7ad57b53b","shasum":""},"require":{"guzzlehttp/guzzle":"^5.3 || ^6.0.1","guzzlehttp/promises":"^1.0.0","guzzlehttp/psr7":"^1.0.0","mtdowling/jmespath.php":"^2.2","php":">=5.5"},"require-dev":{"ext-dom":"*","ext-json":"*","ext-openssl":"*","ext-pcre":"*","ext-simplexml":"*","ext-spl":"*","phpunit/phpunit":"^4.0"},"suggest":{"ext-curl":"To send requests using cURL","ext-openssl":"Allows working with CloudFront private distributions and verifying received SNS messages"},"type":"library","extra":{"branch-alias":{"dev-master":"3.0-dev"}},"autoload":{"psr-4":{"Aws\":"src/"},"files":["src/functions.php"]},"notification-url":"https://packagist.org/downloads/","license":["Apache-2.0"],"authors":[{"name":"Amazon Web Services","homepage":"http://aws.amazon.com"}],"description":"AWS SDK for PHP - Use Amazon Web Services in your PHP project","homepage":"http://aws.amazon.com/sdkforphp","keywords":["amazon","aws","cloud","dynamodb","ec2","glacier","s3","sdk"],"time":"2015-05-27T20:07:42+00:00"},{"name":"doctrine/annotations","version":"v1.5.0","source":{"type":"git","url":"https://github.com/doctrine/annotations.git","reference":"5beebb01b025c94e93686b7a0ed3edae81fe3e7f"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/annotations/zipball/5beebb01b025c94e93686b7a0ed3edae81fe3e7f","reference":"5beebb01b025c94e93686b7a0ed3edae81fe3e7f","shasum":""},"require":{"doctrine/lexer":"1.*","php":"^7.1"},"require-dev":{"doctrine/cache":"1.*","phpunit/phpunit":"^5.7"},"type":"library","extra":{"branch-alias":{"dev-master":"1.5.x-dev"}},"autoload":{"psr-4":{"Doctrine\Common\Annotations\":"lib/Doctrine/Common/Annotations"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Docblock Annotations Parser","homepage":"http://www.doctrine-project.org","keywords":["annotations","docblock","parser"],"time":"2017-07-22T10:58:02+00:00"},{"name":"doctrine/cache","version":"v1.7.1","source":{"type":"git","url":"https://github.com/doctrine/cache.git","reference":"b3217d58609e9c8e661cd41357a54d926c4a2a1a"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/cache/zipball/b3217d58609e9c8e661cd41357a54d926c4a2a1a","reference":"b3217d58609e9c8e661cd41357a54d926c4a2a1a","shasum":""},"require":{"php":"~7.1"},"conflict":{"doctrine/common":">2.2,<2.4"},"require-dev":{"alcaeus/mongo-php-adapter":"^1.1","mongodb/mongodb":"^1.1","phpunit/phpunit":"^5.7","predis/predis":"~1.0"},"suggest":{"alcaeus/mongo-php-adapter":"Required to use legacy MongoDB driver"},"type":"library","extra":{"branch-alias":{"dev-master":"1.7.x-dev"}},"autoload":{"psr-4":{"Doctrine\Common\Cache\":"lib/Doctrine/Common/Cache"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Caching library offering an object-oriented API for many cache backends","homepage":"http://www.doctrine-project.org","keywords":["cache","caching"],"time":"2017-08-25T07:02:50+00:00"},{"name":"doctrine/collections","version":"v1.5.0","source":{"type":"git","url":"https://github.com/doctrine/collections.git","reference":"a01ee38fcd999f34d9bfbcee59dbda5105449cbf"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/collections/zipball/a01ee38fcd999f34d9bfbcee59dbda5105449cbf","reference":"a01ee38fcd999f34d9bfbcee59dbda5105449cbf","shasum":""},"require":{"php":"^7.1"},"require-dev":{"doctrine/coding-standard":"~0.1@dev","phpunit/phpunit":"^5.7"},"type":"library","extra":{"branch-alias":{"dev-master":"1.3.x-dev"}},"autoload":{"psr-0":{"Doctrine\Common\Collections\":"lib/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Collections Abstraction library","homepage":"http://www.doctrine-project.org","keywords":["array","collections","iterator"],"time":"2017-07-22T10:37:32+00:00"},{"name":"doctrine/common","version":"v2.5.0","source":{"type":"git","url":"https://github.com/doctrine/common.git","reference":"cd8daf2501e10c63dced7b8b9b905844316ae9d3"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/common/zipball/cd8daf2501e10c63dced7b8b9b905844316ae9d3","reference":"cd8daf2501e10c63dced7b8b9b905844316ae9d3","shasum":""},"require":{"doctrine/annotations":"1.*","doctrine/cache":"1.*","doctrine/collections":"1.*","doctrine/inflector":"1.*","doctrine/lexer":"1.*","php":">=5.3.2"},"require-dev":{"phpunit/phpunit":"~3.7"},"type":"library","extra":{"branch-alias":{"dev-master":"2.6.x-dev"}},"autoload":{"psr-0":{"Doctrine\Common\":"lib/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Common Library for Doctrine projects","homepage":"http://www.doctrine-project.org","keywords":["annotations","collections","eventmanager","persistence","spl"],"time":"2015-04-02T19:55:44+00:00"},{"name":"doctrine/inflector","version":"v1.2.0","source":{"type":"git","url":"https://github.com/doctrine/inflector.git","reference":"e11d84c6e018beedd929cff5220969a3c6d1d462"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/inflector/zipball/e11d84c6e018beedd929cff5220969a3c6d1d462","reference":"e11d84c6e018beedd929cff5220969a3c6d1d462","shasum":""},"require":{"php":"^7.0"},"require-dev":{"phpunit/phpunit":"^6.2"},"type":"library","extra":{"branch-alias":{"dev-master":"1.2.x-dev"}},"autoload":{"psr-4":{"Doctrine\Common\Inflector\":"lib/Doctrine/Common/Inflector"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Common String Manipulations with regard to casing and singular/plural rules.","homepage":"http://www.doctrine-project.org","keywords":["inflection","pluralize","singularize","string"],"time":"2017-07-22T12:18:28+00:00"},{"name":"doctrine/lexer","version":"v1.0.1","source":{"type":"git","url":"https://github.com/doctrine/lexer.git","reference":"83893c552fd2045dd78aef794c31e694c37c0b8c"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/lexer/zipball/83893c552fd2045dd78aef794c31e694c37c0b8c","reference":"83893c552fd2045dd78aef794c31e694c37c0b8c","shasum":""},"require":{"php":">=5.3.2"},"type":"library","extra":{"branch-alias":{"dev-master":"1.0.x-dev"}},"autoload":{"psr-0":{"Doctrine\Common\Lexer\":"lib/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Base library for a lexer that can be used in Top-Down, Recursive Descent Parsers.","homepage":"http://www.doctrine-project.org","keywords":["lexer","parser"],"time":"2014-09-09T13:34:57+00:00"},{"name":"guzzlehttp/guzzle","version":"6.3.0","source":{"type":"git","url":"https://github.com/guzzle/guzzle.git","reference":"f4db5a78a5ea468d4831de7f0bf9d9415e348699"},"dist":{"type":"zip","url":"https://api.github.com/repos/guzzle/guzzle/zipball/f4db5a78a5ea468d4831de7f0bf9d9415e348699","reference":"f4db5a78a5ea468d4831de7f0bf9d9415e348699","shasum":""},"require":{"guzzlehttp/promises":"^1.0","guzzlehttp/psr7":"^1.4","php":">=5.5"},"require-dev":{"ext-curl":"*","phpunit/phpunit":"^4.0 || ^5.0","psr/log":"^1.0"},"suggest":{"psr/log":"Required for using the Log middleware"},"type":"library","extra":{"branch-alias":{"dev-master":"6.2-dev"}},"autoload":{"files":["src/functions_include.php"],"psr-4":{"GuzzleHttp\":"src/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"}],"description":"Guzzle is a PHP HTTP client library","homepage":"http://guzzlephp.org/","keywords":["client","curl","framework","http","http client","rest","web service"],"time":"2017-06-22T18:50:49+00:00"},{"name":"guzzlehttp/promises","version":"v1.3.1","source":{"type":"git","url":"https://github.com/guzzle/promises.git","reference":"a59da6cf61d80060647ff4d3eb2c03a2bc694646"},"dist":{"type":"zip","url":"https://api.github.com/repos/guzzle/promises/zipball/a59da6cf61d80060647ff4d3eb2c03a2bc694646","reference":"a59da6cf61d80060647ff4d3eb2c03a2bc694646","shasum":""},"require":{"php":">=5.5.0"},"require-dev":{"phpunit/phpunit":"^4.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.4-dev"}},"autoload":{"psr-4":{"GuzzleHttp\Promise\":"src/"},"files":["src/functions_include.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"}],"description":"Guzzle promises library","keywords":["promise"],"time":"2016-12-20T10:07:11+00:00"},{"name":"guzzlehttp/psr7","version":"1.4.2","source":{"type":"git","url":"https://github.com/guzzle/psr7.git","reference":"f5b8a8512e2b58b0071a7280e39f14f72e05d87c"},"dist":{"type":"zip","url":"https://api.github.com/repos/guzzle/psr7/zipball/f5b8a8512e2b58b0071a7280e39f14f72e05d87c","reference":"f5b8a8512e2b58b0071a7280e39f14f72e05d87c","shasum":""},"require":{"php":">=5.4.0","psr/http-message":"~1.0"},"provide":{"psr/http-message-implementation":"1.0"},"require-dev":{"phpunit/phpunit":"~4.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.4-dev"}},"autoload":{"psr-4":{"GuzzleHttp\Psr7\":"src/"},"files":["src/functions_include.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"},{"name":"Tobias Schultze","homepage":"https://github.com/Tobion"}],"description":"PSR-7 message implementation that also provides common utility methods","keywords":["http","message","request","response","stream","uri","url"],"time":"2017-03-20T17:10:46+00:00"},{"name":"mtdowling/jmespath.php","version":"2.4.0","source":{"type":"git","url":"https://github.com/jmespath/jmespath.php.git","reference":"adcc9531682cf87dfda21e1fd5d0e7a41d292fac"},"dist":{"type":"zip","url":"https://api.github.com/repos/jmespath/jmespath.php/zipball/adcc9531682cf87dfda21e1fd5d0e7a41d292fac","reference":"adcc9531682cf87dfda21e1fd5d0e7a41d292fac","shasum":""},"require":{"php":">=5.4.0"},"require-dev":{"phpunit/phpunit":"~4.0"},"bin":["bin/jp.php"],"type":"library","extra":{"branch-alias":{"dev-master":"2.0-dev"}},"autoload":{"psr-4":{"JmesPath\":"src/"},"files":["src/JmesPath.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"}],"description":"Declaratively specify how to extract elements from a JSON document","keywords":["json","jsonpath"],"time":"2016-12-03T22:08:25+00:00"},{"name":"psr/http-message","version":"1.0.1","source":{"type":"git","url":"https://github.com/php-fig/http-message.git","reference":"f6561bf28d520154e4b0ec72be95418abe6d9363"},"dist":{"type":"zip","url":"https://api.github.com/repos/php-fig/http-message/zipball/f6561bf28d520154e4b0ec72be95418abe6d9363","reference":"f6561bf28d520154e4b0ec72be95418abe6d9363","shasum":""},"require":{"php":">=5.3.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.0.x-dev"}},"autoload":{"psr-4":{"Psr\Http\Message\":"src/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"PHP-FIG","homepage":"http://www.php-fig.org/"}],"description":"Common interface for HTTP messages","homepage":"https://github.com/php-fig/http-message","keywords":["http","http-message","psr","psr-7","request","response"],"time":"2016-08-06T14:39:51+00:00"},{"name":"psr/log","version":"1.0.2","source":{"type":"git","url":"https://github.com/php-fig/log.git","reference":"4ebe3a8bf773a19edfe0a84b6585ba3d401b724d"},"dist":{"type":"zip","url":"https://api.github.com/repos/php-fig/log/zipball/4ebe3a8bf773a19edfe0a84b6585ba3d401b724d","reference":"4ebe3a8bf773a19edfe0a84b6585ba3d401b724d","shasum":""},"require":{"php":">=5.3.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.0.x-dev"}},"autoload":{"psr-4":{"Psr\Log\":"Psr/Log/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"PHP-FIG","homepage":"http://www.php-fig.org/"}],"description":"Common interface for logging libraries","homepage":"https://github.com/php-fig/log","keywords":["log","psr","psr-3"],"time":"2016-10-10T12:19:37+00:00"},{"name":"symfony/icu","version":"v1.2.2","target-dir":"Symfony/Component/Icu","source":{"type":"git","url":"https://github.com/symfony/icu.git","reference":"d4d85d6055b87f394d941b45ddd3a9173e1e3d2a"},"dist":{"type":"zip","url":"https://api.github.com/repos/symfony/icu/zipball/d4d85d6055b87f394d941b45ddd3a9173e1e3d2a","reference":"d4d85d6055b87f394d941b45ddd3a9173e1e3d2a","shasum":""},"require":{"ext-intl":"*","lib-icu":">=4.4","php":">=5.3.3","symfony/intl":"~2.3"},"type":"library","autoload":{"psr-0":{"Symfony\Component\Icu\":""}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Symfony Community","homepage":"http://symfony.com/contributors"},{"name":"Bernhard Schussek","email":"bschussek@gmail.com"}],"description":"Contains an excerpt of the ICU data and classes to load it.","homepage":"http://symfony.com","keywords":["icu","intl"],"abandoned":"symfony/intl","time":"2014-07-25T09:58:17+00:00"},{"name":"symfony/symfony","version":"v2.3.1","source":{"type":"git","url":"https://github.com/symfony/symfony.git","reference":"0902c606b4df1161f5b786ae89f37b71380b1f23"},"dist":{"type":"zip","url":"https://api.github.com/repos/symfony/symfony/zipball/0902c606b4df1161f5b786ae89f37b71380b1f23","reference":"0902c606b4df1161f5b786ae89f37b71380b1f23","shasum":""},"require":{"doctrine/common":"~2.2","php":">=5.3.3","psr/log":"~1.0","symfony/icu":"~1.0","twig/twig":"~1.11"},"replace":{"symfony/browser-kit":"self.version","symfony/class-loader":"self.version","symfony/config":"self.version","symfony/console":"self.version","symfony/css-selector":"self.version","symfony/debug":"self.version","symfony/dependency-injection":"self.version","symfony/doctrine-bridge":"self.version","symfony/dom-crawler":"self.version","symfony/event-dispatcher":"self.version","symfony/filesystem":"self.version","symfony/finder":"self.version","symfony/form":"self.version","symfony/framework-bundle":"self.version","symfony/http-foundation":"self.version","symfony/http-kernel":"self.version","symfony/intl":"self.version","symfony/locale":"self.version","symfony/monolog-bridge":"self.version","symfony/options-resolver":"self.version","symfony/process":"self.version","symfony/propel1-bridge":"self.version","symfony/property-access":"self.version","symfony/proxy-manager-bridge":"self.version","symfony/routing":"self.version","symfony/security":"self.version","symfony/security-bundle":"self.version","symfony/serializer":"self.version","symfony/stopwatch":"self.version","symfony/swiftmailer-bridge":"self.version","symfony/templating":"self.version","symfony/translation":"self.version","symfony/twig-bridge":"self.version","symfony/twig-bundle":"self.version","symfony/validator":"self.version","symfony/web-profiler-bundle":"self.version","symfony/yaml":"self.version"},"require-dev":{"doctrine/data-fixtures":"1.0.*","doctrine/dbal":"~2.2","doctrine/orm":"~2.2,>=2.2.3","ircmaxell/password-compat":"1.0.*","monolog/monolog":"~1.3","ocramius/proxy-manager":">=0.3.1,<0.4-dev","propel/propel1":"1.6.*"},"type":"library","extra":{"branch-alias":{"dev-master":"2.3-dev"}},"autoload":{"psr-0":{"Symfony\":"src/"},"classmap":["src/Symfony/Component/HttpFoundation/Resources/stubs","src/Symfony/Component/Intl/Resources/stubs"],"files":["src/Symfony/Component/Intl/Resources/stubs/functions.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Symfony Community","homepage":"http://symfony.com/contributors"},{"name":"Fabien Potencier","email":"fabien@symfony.com"}],"description":"The Symfony PHP framework","homepage":"http://symfony.com","keywords":["framework"],"time":"2013-06-11T11:46:38+00:00"},{"name":"twig/twig","version":"v1.35.0","source":{"type":"git","url":"https://github.com/twigphp/Twig.git","reference":"daa657073e55b0a78cce8fdd22682fddecc6385f"},"dist":{"type":"zip","url":"https://api.github.com/repos/twigphp/Twig/zipball/daa657073e55b0a78cce8fdd22682fddecc6385f","reference":"daa657073e55b0a78cce8fdd22682fddecc6385f","shasum":""},"require":{"php":">=5.3.3"},"require-dev":{"psr/container":"^1.0","symfony/debug":"~2.7","symfony/phpunit-bridge":"~3.3@dev"},"type":"library","extra":{"branch-alias":{"dev-master":"1.35-dev"}},"autoload":{"psr-0":{"Twig_":"lib/"},"psr-4":{"Twig\":"src/"}},"notification-url":"https://packagist.org/downloads/","license":["BSD-3-Clause"],"authors":[{"name":"Fabien Potencier","email":"fabien@symfony.com","homepage":"http://fabien.potencier.org","role":"Lead Developer"},{"name":"Armin Ronacher","email":"armin.ronacher@active-4.com","role":"Project Founder"},{"name":"Twig Team","homepage":"http://twig.sensiolabs.org/contributors","role":"Contributors"}],"description":"Twig, the flexible, fast, and secure template language for PHP","homepage":"http://twig.sensiolabs.org","keywords":["templating"],"time":"2017-09-27T18:06:46+00:00"},{"name":"yiisoft/yii","version":"1.1.14","source":{"type":"git","url":"https://github.com/yiisoft/yii.git","reference":"f0fee98ee84f70f1f3652f65562c9670e919cb4e"},"dist":{"type":"zip","url":"https://api.github.com/repos/yiisoft/yii/zipball/f0fee98ee84f70f1f3652f65562c9670e919cb4e","reference":"f0fee98ee84f70f1f3652f65562c9670e919cb4e","shasum":""},"require":{"php":">=5.1.0"},"bin":["framework/yiic"],"type":"library","notification-url":"https://packagist.org/downloads/","license":["BSD-3-Clause"],"authors":[{"name":"Qiang Xue","email":"qiang.xue@gmail.com","homepage":"http://www.yiiframework.com/","role":"Founder and project lead"},{"name":"Alexander Makarov","email":"sam@rmcreative.ru","homepage":"http://rmcreative.ru/","role":"Core framework development"},{"name":"Maurizio Domba","homepage":"http://mdomba.info/","role":"Core framework development"},{"name":"Carsten Brandt","email":"mail@cebe.cc","homepage":"http://cebe.cc/","role":"Core framework development"},{"name":"Wei Zhuo","email":"weizhuo@gmail.com","role":"Project site maintenance and development"},{"name":"Sebastián Thierer","email":"sebas@artfos.com","role":"Component development"},{"name":"Jeffrey Winesett","email":"jefftulsa@gmail.com","role":"Documentation and marketing"},{"name":"Timur Ruziev","email":"resurtm@gmail.com","homepage":"http://resurtm.com/","role":"Core framework development"},{"name":"Paul Klimov","email":"klimov.paul@gmail.com","role":"Core framework development"}],"description":"Yii Web Programming Framework","homepage":"http://www.yiiframework.com/","keywords":["framework","yii"],"time":"2013-08-12T00:12:08+00:00"},{"name":"zendframework/zendframework","version":"2.1.0","source":{"type":"git","url":"https://github.com/zendframework/zendframework.git","reference":"345a8cbedbe8de8a25bf18579fe54d169ac5075a"},"dist":{"type":"zip","url":"https://api.github.com/repos/zendframework/zendframework/zipball/345a8cbedbe8de8a25bf18579fe54d169ac5075a","reference":"345a8cbedbe8de8a25bf18579fe54d169ac5075a","shasum":""},"require":{"php":">=5.3.3"},"replace":{"zendframework/zend-authentication":"self.version","zendframework/zend-barcode":"self.version","zendframework/zend-cache":"self.version","zendframework/zend-captcha":"self.version","zendframework/zend-code":"self.version","zendframework/zend-config":"self.version","zendframework/zend-console":"self.version","zendframework/zend-crypt":"self.version","zendframework/zend-db":"self.version","zendframework/zend-debug":"self.version","zendframework/zend-di":"self.version","zendframework/zend-dom":"self.version","zendframework/zend-escaper":"self.version","zendframework/zend-eventmanager":"self.version","zendframework/zend-feed":"self.version","zendframework/zend-file":"self.version","zendframework/zend-filter":"self.version","zendframework/zend-form":"self.version","zendframework/zend-http":"self.version","zendframework/zend-i18n":"self.version","zendframework/zend-inputfilter":"self.version","zendframework/zend-json":"self.version","zendframework/zend-ldap":"self.version","zendframework/zend-loader":"self.version","zendframework/zend-log":"self.version","zendframework/zend-mail":"self.version","zendframework/zend-math":"self.version","zendframework/zend-memory":"self.version","zendframework/zend-mime":"self.version","zendframework/zend-modulemanager":"self.version","zendframework/zend-mvc":"self.version","zendframework/zend-navigation":"self.version","zendframework/zend-paginator":"self.version","zendframework/zend-permissions-acl":"self.version","zendframework/zend-permissions-rbac":"self.version","zendframework/zend-progressbar":"self.version","zendframework/zend-serializer":"self.version","zendframework/zend-server":"self.version","zendframework/zend-servicemanager":"self.version","zendframework/zend-session":"self.version","zendframework/zend-soap":"self.version","zendframework/zend-stdlib":"self.version","zendframework/zend-tag":"self.version","zendframework/zend-test":"self.version","zendframework/zend-text":"self.version","zendframework/zend-uri":"self.version","zendframework/zend-validator":"self.version","zendframework/zend-version":"self.version","zendframework/zend-view":"self.version","zendframework/zend-xmlrpc":"self.version"},"require-dev":{"doctrine/common":">=2.1","phpunit/phpunit":"3.7.*"},"suggest":{"doctrine/common":"Doctrine\Common >=2.1 for annotation features","ext-intl":"ext/intl for i18n features","pecl-weakref":"Implementation of weak references for Zend\Stdlib\CallbackHandler","zendframework/zendpdf":"ZendPdf for creating PDF representations of barcodes","zendframework/zendservice-recaptcha":"ZendService\ReCaptcha for rendering ReCaptchas in Zend\Captcha and/or Zend\Form"},"bin":["bin/classmap_generator.php"],"type":"library","extra":{"branch-alias":{"dev-master":"2.1-dev","dev-develop":"2.2-dev"}},"autoload":{"psr-0":{"Zend\":"library/","ZendTest\":"tests/"}},"notification-url":"https://packagist.org/downloads/","license":["BSD-3-Clause"],"description":"Zend Framework 2","homepage":"http://framework.zend.com/","keywords":["framework","zf2"],"time":"2013-01-30T16:46:21+00:00"}],"packages-dev":[],"aliases":[],"minimum-stability":"stable","stability-flags":[],"prefer-stable":false,"prefer-lowest":false,"platform":{"php":">=5.3.2"},"platform-dev":[]}'
            example:
              encoding: plain
              files:
                target:
                  contents: '{"name": "vulnerable/project","description": "A sample vulnerable project","require": {"php": ">=5.3.2","symfony/symfony": "v2.3.1","yiisoft/yii": "1.1.14","zendframework/zendframework": "2.1.0","aws/aws-sdk-php": "3.0.0","doctrine/common": "2.5.0"}}'
                additional:
                  - contents: '{"_readme":["This file locks the dependencies of your project to a known state","Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file","This file is @generated automatically"],"content-hash":"3a3771e545494c4c098e639bd68602ba","packages":[{"name":"aws/aws-sdk-php","version":"3.0.0","source":{"type":"git","url":"https://github.com/aws/aws-sdk-php.git","reference":"4018c8f14a9e53003bb0417fa859c6a7ad57b53b"},"dist":{"type":"zip","url":"https://api.github.com/repos/aws/aws-sdk-php/zipball/4018c8f14a9e53003bb0417fa859c6a7ad57b53b","reference":"4018c8f14a9e53003bb0417fa859c6a7ad57b53b","shasum":""},"require":{"guzzlehttp/guzzle":"^5.3 || ^6.0.1","guzzlehttp/promises":"^1.0.0","guzzlehttp/psr7":"^1.0.0","mtdowling/jmespath.php":"^2.2","php":">=5.5"},"require-dev":{"ext-dom":"*","ext-json":"*","ext-openssl":"*","ext-pcre":"*","ext-simplexml":"*","ext-spl":"*","phpunit/phpunit":"^4.0"},"suggest":{"ext-curl":"To send requests using cURL","ext-openssl":"Allows working with CloudFront private distributions and verifying received SNS messages"},"type":"library","extra":{"branch-alias":{"dev-master":"3.0-dev"}},"autoload":{"psr-4":{"Aws\":"src/"},"files":["src/functions.php"]},"notification-url":"https://packagist.org/downloads/","license":["Apache-2.0"],"authors":[{"name":"Amazon Web Services","homepage":"http://aws.amazon.com"}],"description":"AWS SDK for PHP - Use Amazon Web Services in your PHP project","homepage":"http://aws.amazon.com/sdkforphp","keywords":["amazon","aws","cloud","dynamodb","ec2","glacier","s3","sdk"],"time":"2015-05-27T20:07:42+00:00"},{"name":"doctrine/annotations","version":"v1.5.0","source":{"type":"git","url":"https://github.com/doctrine/annotations.git","reference":"5beebb01b025c94e93686b7a0ed3edae81fe3e7f"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/annotations/zipball/5beebb01b025c94e93686b7a0ed3edae81fe3e7f","reference":"5beebb01b025c94e93686b7a0ed3edae81fe3e7f","shasum":""},"require":{"doctrine/lexer":"1.*","php":"^7.1"},"require-dev":{"doctrine/cache":"1.*","phpunit/phpunit":"^5.7"},"type":"library","extra":{"branch-alias":{"dev-master":"1.5.x-dev"}},"autoload":{"psr-4":{"Doctrine\Common\Annotations\":"lib/Doctrine/Common/Annotations"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Docblock Annotations Parser","homepage":"http://www.doctrine-project.org","keywords":["annotations","docblock","parser"],"time":"2017-07-22T10:58:02+00:00"},{"name":"doctrine/cache","version":"v1.7.1","source":{"type":"git","url":"https://github.com/doctrine/cache.git","reference":"b3217d58609e9c8e661cd41357a54d926c4a2a1a"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/cache/zipball/b3217d58609e9c8e661cd41357a54d926c4a2a1a","reference":"b3217d58609e9c8e661cd41357a54d926c4a2a1a","shasum":""},"require":{"php":"~7.1"},"conflict":{"doctrine/common":">2.2,<2.4"},"require-dev":{"alcaeus/mongo-php-adapter":"^1.1","mongodb/mongodb":"^1.1","phpunit/phpunit":"^5.7","predis/predis":"~1.0"},"suggest":{"alcaeus/mongo-php-adapter":"Required to use legacy MongoDB driver"},"type":"library","extra":{"branch-alias":{"dev-master":"1.7.x-dev"}},"autoload":{"psr-4":{"Doctrine\Common\Cache\":"lib/Doctrine/Common/Cache"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Caching library offering an object-oriented API for many cache backends","homepage":"http://www.doctrine-project.org","keywords":["cache","caching"],"time":"2017-08-25T07:02:50+00:00"},{"name":"doctrine/collections","version":"v1.5.0","source":{"type":"git","url":"https://github.com/doctrine/collections.git","reference":"a01ee38fcd999f34d9bfbcee59dbda5105449cbf"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/collections/zipball/a01ee38fcd999f34d9bfbcee59dbda5105449cbf","reference":"a01ee38fcd999f34d9bfbcee59dbda5105449cbf","shasum":""},"require":{"php":"^7.1"},"require-dev":{"doctrine/coding-standard":"~0.1@dev","phpunit/phpunit":"^5.7"},"type":"library","extra":{"branch-alias":{"dev-master":"1.3.x-dev"}},"autoload":{"psr-0":{"Doctrine\Common\Collections\":"lib/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Collections Abstraction library","homepage":"http://www.doctrine-project.org","keywords":["array","collections","iterator"],"time":"2017-07-22T10:37:32+00:00"},{"name":"doctrine/common","version":"v2.5.0","source":{"type":"git","url":"https://github.com/doctrine/common.git","reference":"cd8daf2501e10c63dced7b8b9b905844316ae9d3"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/common/zipball/cd8daf2501e10c63dced7b8b9b905844316ae9d3","reference":"cd8daf2501e10c63dced7b8b9b905844316ae9d3","shasum":""},"require":{"doctrine/annotations":"1.*","doctrine/cache":"1.*","doctrine/collections":"1.*","doctrine/inflector":"1.*","doctrine/lexer":"1.*","php":">=5.3.2"},"require-dev":{"phpunit/phpunit":"~3.7"},"type":"library","extra":{"branch-alias":{"dev-master":"2.6.x-dev"}},"autoload":{"psr-0":{"Doctrine\Common\":"lib/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Common Library for Doctrine projects","homepage":"http://www.doctrine-project.org","keywords":["annotations","collections","eventmanager","persistence","spl"],"time":"2015-04-02T19:55:44+00:00"},{"name":"doctrine/inflector","version":"v1.2.0","source":{"type":"git","url":"https://github.com/doctrine/inflector.git","reference":"e11d84c6e018beedd929cff5220969a3c6d1d462"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/inflector/zipball/e11d84c6e018beedd929cff5220969a3c6d1d462","reference":"e11d84c6e018beedd929cff5220969a3c6d1d462","shasum":""},"require":{"php":"^7.0"},"require-dev":{"phpunit/phpunit":"^6.2"},"type":"library","extra":{"branch-alias":{"dev-master":"1.2.x-dev"}},"autoload":{"psr-4":{"Doctrine\Common\Inflector\":"lib/Doctrine/Common/Inflector"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Common String Manipulations with regard to casing and singular/plural rules.","homepage":"http://www.doctrine-project.org","keywords":["inflection","pluralize","singularize","string"],"time":"2017-07-22T12:18:28+00:00"},{"name":"doctrine/lexer","version":"v1.0.1","source":{"type":"git","url":"https://github.com/doctrine/lexer.git","reference":"83893c552fd2045dd78aef794c31e694c37c0b8c"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/lexer/zipball/83893c552fd2045dd78aef794c31e694c37c0b8c","reference":"83893c552fd2045dd78aef794c31e694c37c0b8c","shasum":""},"require":{"php":">=5.3.2"},"type":"library","extra":{"branch-alias":{"dev-master":"1.0.x-dev"}},"autoload":{"psr-0":{"Doctrine\Common\Lexer\":"lib/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Base library for a lexer that can be used in Top-Down, Recursive Descent Parsers.","homepage":"http://www.doctrine-project.org","keywords":["lexer","parser"],"time":"2014-09-09T13:34:57+00:00"},{"name":"guzzlehttp/guzzle","version":"6.3.0","source":{"type":"git","url":"https://github.com/guzzle/guzzle.git","reference":"f4db5a78a5ea468d4831de7f0bf9d9415e348699"},"dist":{"type":"zip","url":"https://api.github.com/repos/guzzle/guzzle/zipball/f4db5a78a5ea468d4831de7f0bf9d9415e348699","reference":"f4db5a78a5ea468d4831de7f0bf9d9415e348699","shasum":""},"require":{"guzzlehttp/promises":"^1.0","guzzlehttp/psr7":"^1.4","php":">=5.5"},"require-dev":{"ext-curl":"*","phpunit/phpunit":"^4.0 || ^5.0","psr/log":"^1.0"},"suggest":{"psr/log":"Required for using the Log middleware"},"type":"library","extra":{"branch-alias":{"dev-master":"6.2-dev"}},"autoload":{"files":["src/functions_include.php"],"psr-4":{"GuzzleHttp\":"src/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"}],"description":"Guzzle is a PHP HTTP client library","homepage":"http://guzzlephp.org/","keywords":["client","curl","framework","http","http client","rest","web service"],"time":"2017-06-22T18:50:49+00:00"},{"name":"guzzlehttp/promises","version":"v1.3.1","source":{"type":"git","url":"https://github.com/guzzle/promises.git","reference":"a59da6cf61d80060647ff4d3eb2c03a2bc694646"},"dist":{"type":"zip","url":"https://api.github.com/repos/guzzle/promises/zipball/a59da6cf61d80060647ff4d3eb2c03a2bc694646","reference":"a59da6cf61d80060647ff4d3eb2c03a2bc694646","shasum":""},"require":{"php":">=5.5.0"},"require-dev":{"phpunit/phpunit":"^4.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.4-dev"}},"autoload":{"psr-4":{"GuzzleHttp\Promise\":"src/"},"files":["src/functions_include.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"}],"description":"Guzzle promises library","keywords":["promise"],"time":"2016-12-20T10:07:11+00:00"},{"name":"guzzlehttp/psr7","version":"1.4.2","source":{"type":"git","url":"https://github.com/guzzle/psr7.git","reference":"f5b8a8512e2b58b0071a7280e39f14f72e05d87c"},"dist":{"type":"zip","url":"https://api.github.com/repos/guzzle/psr7/zipball/f5b8a8512e2b58b0071a7280e39f14f72e05d87c","reference":"f5b8a8512e2b58b0071a7280e39f14f72e05d87c","shasum":""},"require":{"php":">=5.4.0","psr/http-message":"~1.0"},"provide":{"psr/http-message-implementation":"1.0"},"require-dev":{"phpunit/phpunit":"~4.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.4-dev"}},"autoload":{"psr-4":{"GuzzleHttp\Psr7\":"src/"},"files":["src/functions_include.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"},{"name":"Tobias Schultze","homepage":"https://github.com/Tobion"}],"description":"PSR-7 message implementation that also provides common utility methods","keywords":["http","message","request","response","stream","uri","url"],"time":"2017-03-20T17:10:46+00:00"},{"name":"mtdowling/jmespath.php","version":"2.4.0","source":{"type":"git","url":"https://github.com/jmespath/jmespath.php.git","reference":"adcc9531682cf87dfda21e1fd5d0e7a41d292fac"},"dist":{"type":"zip","url":"https://api.github.com/repos/jmespath/jmespath.php/zipball/adcc9531682cf87dfda21e1fd5d0e7a41d292fac","reference":"adcc9531682cf87dfda21e1fd5d0e7a41d292fac","shasum":""},"require":{"php":">=5.4.0"},"require-dev":{"phpunit/phpunit":"~4.0"},"bin":["bin/jp.php"],"type":"library","extra":{"branch-alias":{"dev-master":"2.0-dev"}},"autoload":{"psr-4":{"JmesPath\":"src/"},"files":["src/JmesPath.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"}],"description":"Declaratively specify how to extract elements from a JSON document","keywords":["json","jsonpath"],"time":"2016-12-03T22:08:25+00:00"},{"name":"psr/http-message","version":"1.0.1","source":{"type":"git","url":"https://github.com/php-fig/http-message.git","reference":"f6561bf28d520154e4b0ec72be95418abe6d9363"},"dist":{"type":"zip","url":"https://api.github.com/repos/php-fig/http-message/zipball/f6561bf28d520154e4b0ec72be95418abe6d9363","reference":"f6561bf28d520154e4b0ec72be95418abe6d9363","shasum":""},"require":{"php":">=5.3.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.0.x-dev"}},"autoload":{"psr-4":{"Psr\Http\Message\":"src/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"PHP-FIG","homepage":"http://www.php-fig.org/"}],"description":"Common interface for HTTP messages","homepage":"https://github.com/php-fig/http-message","keywords":["http","http-message","psr","psr-7","request","response"],"time":"2016-08-06T14:39:51+00:00"},{"name":"psr/log","version":"1.0.2","source":{"type":"git","url":"https://github.com/php-fig/log.git","reference":"4ebe3a8bf773a19edfe0a84b6585ba3d401b724d"},"dist":{"type":"zip","url":"https://api.github.com/repos/php-fig/log/zipball/4ebe3a8bf773a19edfe0a84b6585ba3d401b724d","reference":"4ebe3a8bf773a19edfe0a84b6585ba3d401b724d","shasum":""},"require":{"php":">=5.3.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.0.x-dev"}},"autoload":{"psr-4":{"Psr\Log\":"Psr/Log/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"PHP-FIG","homepage":"http://www.php-fig.org/"}],"description":"Common interface for logging libraries","homepage":"https://github.com/php-fig/log","keywords":["log","psr","psr-3"],"time":"2016-10-10T12:19:37+00:00"},{"name":"symfony/icu","version":"v1.2.2","target-dir":"Symfony/Component/Icu","source":{"type":"git","url":"https://github.com/symfony/icu.git","reference":"d4d85d6055b87f394d941b45ddd3a9173e1e3d2a"},"dist":{"type":"zip","url":"https://api.github.com/repos/symfony/icu/zipball/d4d85d6055b87f394d941b45ddd3a9173e1e3d2a","reference":"d4d85d6055b87f394d941b45ddd3a9173e1e3d2a","shasum":""},"require":{"ext-intl":"*","lib-icu":">=4.4","php":">=5.3.3","symfony/intl":"~2.3"},"type":"library","autoload":{"psr-0":{"Symfony\Component\Icu\":""}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Symfony Community","homepage":"http://symfony.com/contributors"},{"name":"Bernhard Schussek","email":"bschussek@gmail.com"}],"description":"Contains an excerpt of the ICU data and classes to load it.","homepage":"http://symfony.com","keywords":["icu","intl"],"abandoned":"symfony/intl","time":"2014-07-25T09:58:17+00:00"},{"name":"symfony/symfony","version":"v2.3.1","source":{"type":"git","url":"https://github.com/symfony/symfony.git","reference":"0902c606b4df1161f5b786ae89f37b71380b1f23"},"dist":{"type":"zip","url":"https://api.github.com/repos/symfony/symfony/zipball/0902c606b4df1161f5b786ae89f37b71380b1f23","reference":"0902c606b4df1161f5b786ae89f37b71380b1f23","shasum":""},"require":{"doctrine/common":"~2.2","php":">=5.3.3","psr/log":"~1.0","symfony/icu":"~1.0","twig/twig":"~1.11"},"replace":{"symfony/browser-kit":"self.version","symfony/class-loader":"self.version","symfony/config":"self.version","symfony/console":"self.version","symfony/css-selector":"self.version","symfony/debug":"self.version","symfony/dependency-injection":"self.version","symfony/doctrine-bridge":"self.version","symfony/dom-crawler":"self.version","symfony/event-dispatcher":"self.version","symfony/filesystem":"self.version","symfony/finder":"self.version","symfony/form":"self.version","symfony/framework-bundle":"self.version","symfony/http-foundation":"self.version","symfony/http-kernel":"self.version","symfony/intl":"self.version","symfony/locale":"self.version","symfony/monolog-bridge":"self.version","symfony/options-resolver":"self.version","symfony/process":"self.version","symfony/propel1-bridge":"self.version","symfony/property-access":"self.version","symfony/proxy-manager-bridge":"self.version","symfony/routing":"self.version","symfony/security":"self.version","symfony/security-bundle":"self.version","symfony/serializer":"self.version","symfony/stopwatch":"self.version","symfony/swiftmailer-bridge":"self.version","symfony/templating":"self.version","symfony/translation":"self.version","symfony/twig-bridge":"self.version","symfony/twig-bundle":"self.version","symfony/validator":"self.version","symfony/web-profiler-bundle":"self.version","symfony/yaml":"self.version"},"require-dev":{"doctrine/data-fixtures":"1.0.*","doctrine/dbal":"~2.2","doctrine/orm":"~2.2,>=2.2.3","ircmaxell/password-compat":"1.0.*","monolog/monolog":"~1.3","ocramius/proxy-manager":">=0.3.1,<0.4-dev","propel/propel1":"1.6.*"},"type":"library","extra":{"branch-alias":{"dev-master":"2.3-dev"}},"autoload":{"psr-0":{"Symfony\":"src/"},"classmap":["src/Symfony/Component/HttpFoundation/Resources/stubs","src/Symfony/Component/Intl/Resources/stubs"],"files":["src/Symfony/Component/Intl/Resources/stubs/functions.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Symfony Community","homepage":"http://symfony.com/contributors"},{"name":"Fabien Potencier","email":"fabien@symfony.com"}],"description":"The Symfony PHP framework","homepage":"http://symfony.com","keywords":["framework"],"time":"2013-06-11T11:46:38+00:00"},{"name":"twig/twig","version":"v1.35.0","source":{"type":"git","url":"https://github.com/twigphp/Twig.git","reference":"daa657073e55b0a78cce8fdd22682fddecc6385f"},"dist":{"type":"zip","url":"https://api.github.com/repos/twigphp/Twig/zipball/daa657073e55b0a78cce8fdd22682fddecc6385f","reference":"daa657073e55b0a78cce8fdd22682fddecc6385f","shasum":""},"require":{"php":">=5.3.3"},"require-dev":{"psr/container":"^1.0","symfony/debug":"~2.7","symfony/phpunit-bridge":"~3.3@dev"},"type":"library","extra":{"branch-alias":{"dev-master":"1.35-dev"}},"autoload":{"psr-0":{"Twig_":"lib/"},"psr-4":{"Twig\":"src/"}},"notification-url":"https://packagist.org/downloads/","license":["BSD-3-Clause"],"authors":[{"name":"Fabien Potencier","email":"fabien@symfony.com","homepage":"http://fabien.potencier.org","role":"Lead Developer"},{"name":"Armin Ronacher","email":"armin.ronacher@active-4.com","role":"Project Founder"},{"name":"Twig Team","homepage":"http://twig.sensiolabs.org/contributors","role":"Contributors"}],"description":"Twig, the flexible, fast, and secure template language for PHP","homepage":"http://twig.sensiolabs.org","keywords":["templating"],"time":"2017-09-27T18:06:46+00:00"},{"name":"yiisoft/yii","version":"1.1.14","source":{"type":"git","url":"https://github.com/yiisoft/yii.git","reference":"f0fee98ee84f70f1f3652f65562c9670e919cb4e"},"dist":{"type":"zip","url":"https://api.github.com/repos/yiisoft/yii/zipball/f0fee98ee84f70f1f3652f65562c9670e919cb4e","reference":"f0fee98ee84f70f1f3652f65562c9670e919cb4e","shasum":""},"require":{"php":">=5.1.0"},"bin":["framework/yiic"],"type":"library","notification-url":"https://packagist.org/downloads/","license":["BSD-3-Clause"],"authors":[{"name":"Qiang Xue","email":"qiang.xue@gmail.com","homepage":"http://www.yiiframework.com/","role":"Founder and project lead"},{"name":"Alexander Makarov","email":"sam@rmcreative.ru","homepage":"http://rmcreative.ru/","role":"Core framework development"},{"name":"Maurizio Domba","homepage":"http://mdomba.info/","role":"Core framework development"},{"name":"Carsten Brandt","email":"mail@cebe.cc","homepage":"http://cebe.cc/","role":"Core framework development"},{"name":"Wei Zhuo","email":"weizhuo@gmail.com","role":"Project site maintenance and development"},{"name":"Sebastián Thierer","email":"sebas@artfos.com","role":"Component development"},{"name":"Jeffrey Winesett","email":"jefftulsa@gmail.com","role":"Documentation and marketing"},{"name":"Timur Ruziev","email":"resurtm@gmail.com","homepage":"http://resurtm.com/","role":"Core framework development"},{"name":"Paul Klimov","email":"klimov.paul@gmail.com","role":"Core framework development"}],"description":"Yii Web Programming Framework","homepage":"http://www.yiiframework.com/","keywords":["framework","yii"],"time":"2013-08-12T00:12:08+00:00"},{"name":"zendframework/zendframework","version":"2.1.0","source":{"type":"git","url":"https://github.com/zendframework/zendframework.git","reference":"345a8cbedbe8de8a25bf18579fe54d169ac5075a"},"dist":{"type":"zip","url":"https://api.github.com/repos/zendframework/zendframework/zipball/345a8cbedbe8de8a25bf18579fe54d169ac5075a","reference":"345a8cbedbe8de8a25bf18579fe54d169ac5075a","shasum":""},"require":{"php":">=5.3.3"},"replace":{"zendframework/zend-authentication":"self.version","zendframework/zend-barcode":"self.version","zendframework/zend-cache":"self.version","zendframework/zend-captcha":"self.version","zendframework/zend-code":"self.version","zendframework/zend-config":"self.version","zendframework/zend-console":"self.version","zendframework/zend-crypt":"self.version","zendframework/zend-db":"self.version","zendframework/zend-debug":"self.version","zendframework/zend-di":"self.version","zendframework/zend-dom":"self.version","zendframework/zend-escaper":"self.version","zendframework/zend-eventmanager":"self.version","zendframework/zend-feed":"self.version","zendframework/zend-file":"self.version","zendframework/zend-filter":"self.version","zendframework/zend-form":"self.version","zendframework/zend-http":"self.version","zendframework/zend-i18n":"self.version","zendframework/zend-inputfilter":"self.version","zendframework/zend-json":"self.version","zendframework/zend-ldap":"self.version","zendframework/zend-loader":"self.version","zendframework/zend-log":"self.version","zendframework/zend-mail":"self.version","zendframework/zend-math":"self.version","zendframework/zend-memory":"self.version","zendframework/zend-mime":"self.version","zendframework/zend-modulemanager":"self.version","zendframework/zend-mvc":"self.version","zendframework/zend-navigation":"self.version","zendframework/zend-paginator":"self.version","zendframework/zend-permissions-acl":"self.version","zendframework/zend-permissions-rbac":"self.version","zendframework/zend-progressbar":"self.version","zendframework/zend-serializer":"self.version","zendframework/zend-server":"self.version","zendframework/zend-servicemanager":"self.version","zendframework/zend-session":"self.version","zendframework/zend-soap":"self.version","zendframework/zend-stdlib":"self.version","zendframework/zend-tag":"self.version","zendframework/zend-test":"self.version","zendframework/zend-text":"self.version","zendframework/zend-uri":"self.version","zendframework/zend-validator":"self.version","zendframework/zend-version":"self.version","zendframework/zend-view":"self.version","zendframework/zend-xmlrpc":"self.version"},"require-dev":{"doctrine/common":">=2.1","phpunit/phpunit":"3.7.*"},"suggest":{"doctrine/common":"Doctrine\Common >=2.1 for annotation features","ext-intl":"ext/intl for i18n features","pecl-weakref":"Implementation of weak references for Zend\Stdlib\CallbackHandler","zendframework/zendpdf":"ZendPdf for creating PDF representations of barcodes","zendframework/zendservice-recaptcha":"ZendService\ReCaptcha for rendering ReCaptchas in Zend\Captcha and/or Zend\Form"},"bin":["bin/classmap_generator.php"],"type":"library","extra":{"branch-alias":{"dev-master":"2.1-dev","dev-develop":"2.2-dev"}},"autoload":{"psr-0":{"Zend\":"library/","ZendTest\":"tests/"}},"notification-url":"https://packagist.org/downloads/","license":["BSD-3-Clause"],"description":"Zend Framework 2","homepage":"http://framework.zend.com/","keywords":["framework","zf2"],"time":"2013-01-30T16:46:21+00:00"}],"packages-dev":[],"aliases":[],"minimum-stability":"stable","stability-flags":[],"prefer-stable":false,"prefer-lowest":false,"platform":{"php":">=5.3.2"},"platform-dev":[]}'
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Testcomposer.jsoncomposer.lockfileresponse'
                  - example:
                      ok: false
                      issues:
                        vulnerabilities:
                          - id: SNYK-PHP-AWSAWSSDKPHP-70003
                            url: https://snyk.io/vuln/SNYK-PHP-AWSAWSSDKPHP-70003
                            title: Arbitrary Code Execution
                            type: vuln
                            description: >
                              ## Overview
                                Affected versions of [`aws/aws-sdk-php`](https://packagist.org/packages/aws/aws-sdk-php) are vulnerable to Arbitrary Code Execution.

                              Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.


                              ## Remediation

                              Upgrade `aws/aws-sdk-php` to version 3.2.1 or higher.


                              ## References

                              - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-5723)

                              - [Github ChangeLog](https://github.com/aws/aws-sdk-php/blob/master/CHANGELOG.md#321---2015-07-23)
                            functions: []
                            from:
                              - aws/aws-sdk-php@3.0.0
                            package: aws/aws-sdk-php
                            version: 3.0.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <3.2.1
                            publicationTime: 2015-07-24T00:41:41Z
                            disclosureTime: 2015-07-24T00:41:41Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-5723
                              CWE:
                                - CWE-264
                            credit:
                              - Ryan Lane
                            CVSSv3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 7.8
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-DOCTRINECOMMON-70024
                            url: https://snyk.io/vuln/SNYK-PHP-DOCTRINECOMMON-70024
                            title: Arbitrary Code Execution
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`doctrine/common`](https://packagist.org/packages/doctrine/common) are vulnerable to Arbitrary Code Execution.


                              Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.


                              ## Remediation

                              Upgrade `doctrine/common` to version 2.5.1, 2.4.3 or higher.


                              ## References

                              - [Doctrine Release Notes](http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html)
                            functions: []
                            from:
                              - doctrine/common@2.5.0
                            package: doctrine/common
                            version: 2.5.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.4.3
                                - '>=2.5.0, <2.5.1'
                            publicationTime: 2015-08-31T14:42:59Z
                            disclosureTime: 2015-08-31T14:42:59Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-5723
                              CWE:
                                - CWE-94
                            credit:
                              - Ryan Lane
                            CVSSv3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 7.8
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-DOCTRINECOMMON-70024
                            url: https://snyk.io/vuln/SNYK-PHP-DOCTRINECOMMON-70024
                            title: Arbitrary Code Execution
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`doctrine/common`](https://packagist.org/packages/doctrine/common) are vulnerable to Arbitrary Code Execution.


                              Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.


                              ## Remediation

                              Upgrade `doctrine/common` to version 2.5.1, 2.4.3 or higher.


                              ## References

                              - [Doctrine Release Notes](http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                              - doctrine/common@2.5.0
                            package: doctrine/common
                            version: 2.5.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.4.3
                                - '>=2.5.0, <2.5.1'
                            publicationTime: 2015-08-31T14:42:59Z
                            disclosureTime: 2015-08-31T14:42:59Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-5723
                              CWE:
                                - CWE-94
                            credit:
                              - Ryan Lane
                            CVSSv3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 7.8
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-173743
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-173743
                            title: Cross-site Scripting (XSS)
                            type: vuln
                            description: "## Overview\n\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a PHP framework for web applications and a set of reusable PHP components.\n\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS).\nA remote attacker could inject arbitrary web script or HTML via the \"file\" parameter in a URL.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\n\nUpgrade `symfony/symfony` to version 4.1 or higher.\n\n\n## References\n\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-12040)\n"
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <4.1
                            publicationTime: 2018-06-14T00:35:49Z
                            disclosureTime: 2018-06-08T00:35:49Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-12040
                              CWE:
                                - CWE-79
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
                            cvssScore: 6.1
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-173744
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-173744
                            title: Host Header Injection
                            type: vuln
                            description: >
                              ## Overview


                              [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a PHP framework for web applications and a set of reusable PHP components.



                              Affected versions of this package are vulnerable to Host Header Injection.

                              When using `HttpCache`, the values of the `X-Forwarded-Host` headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.


                              ## Remediation


                              Upgrade `symfony/symfony` to version 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.2 or higher.



                              ## References


                              - [GitHub Commit](https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a)


                              - [GitHub Release Tag 4.1.3](https://github.com/symfony/symfony/releases/tag/v4.1.3)


                              - [Symphony Security Blog](https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.7.49
                                - '>=2.8.0, <2.8.44'
                                - '>=3.3.0, <3.3.18'
                                - '>=3.4.0, <3.4.14'
                                - '>=4.0.0, <4.0.14'
                                - '>=4.1.0, <4.1.2'
                            publicationTime: 2018-08-05T13:44:27Z
                            disclosureTime: 2018-07-31T17:24:43Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-14774
                              CWE:
                                - CWE-444
                            credit:
                              - Chaosversum
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
                            cvssScore: 7.2
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-173745
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-173745
                            title: Cross-site Scripting (XSS)
                            type: vuln
                            description: "## Overview\n\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a PHP framework for web applications and a set of reusable PHP components.\n\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS)\nvia the content page.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\n\nUpgrade `symfony/symfony` to version 2.7.7 or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/symphonycms/symphony-2/commit/1ace6b31867cc83267b3550686271c9c65ac3ec0)\n\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-12043)\n"
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.7.7
                            publicationTime: 2018-06-13T10:56:51Z
                            disclosureTime: 2018-06-07T21:05:47Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-12043
                              CWE:
                                - CWE-79
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
                            cvssScore: 6.1
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70207
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70207
                            title: Loss of Information
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Loss of Information.


                              When using the Validator component, if Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache is enabled (or any other cache implementing Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface), some information is lost during serialization (the collectionCascaded and the collectionCascadedDeeply fields).


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.3, 2.1.12, 2.2.5, 2.0.24 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: low
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.3'
                                - '>=2.1.0, <2.1.12'
                                - '>=2.2.0, <2.2.5'
                                - '>=2, <2.0.24'
                            publicationTime: 2013-08-17T07:55:32Z
                            disclosureTime: 2013-08-17T07:55:32Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2013-4751
                              CWE:
                                - CWE-221
                            credit:
                              - Alexandre Salome
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 3.7
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70208
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70208
                            title: HTTP Host Header Poisoning
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to HTTP Host Header Poisoning.


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.3, 2.1.12, 2.2.5, 2.0.24 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.3'
                                - '>=2.1.0, <2.1.12'
                                - '>=2.2.0, <2.2.5'
                                - '>=2, <2.0.24'
                            publicationTime: 2013-08-17T09:14:49Z
                            disclosureTime: 2013-08-17T09:14:49Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2013-4752
                              CWE:
                                - CWE-74
                            credit:
                              - Jordan Alliot
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
                            cvssScore: 8.2
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70209
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70209
                            title: Denial of Service (DoS)
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Denial of Service (DoS).


                              The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to [CVE-2013-5750](https://snyk.io/vuln/SNYK-PHP-FRIENDSOFSYMFONYUSERBUNDLE-70102).


                              ## Details

                              Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                              Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                              One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                              When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                              Two common types of DoS vulnerabilities:



                              * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                              * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.6, 2.1.13, 2.2.9, 2.0.25 or higher.


                              ## References

                              - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-5958)

                              - [Symfony Release Notes](http://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2, <2.0.25'
                                - '>=2.1.0, <2.1.13'
                                - '>=2.2.0, <2.2.9'
                                - '>=2.3.0, <2.3.6'
                            publicationTime: 2013-10-10T08:30:51Z
                            disclosureTime: 2013-10-10T08:30:51Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2013-5958
                              CWE:
                                - CWE-400
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                            cvssScore: 5.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70210
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70210
                            title: Arbitrary Code Injection
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Arbitrary Code Injection.


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/security-releases-cve-2014-4931-symfony-2-3-18-2-4-8-and-2-5-2-released)

                              - [GitHub Commit](https://github.com/symfony/symfony/commit/06a80fbdbe744ad6f3010479ba64ef5cf35dd9af)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.19'
                                - '>=2.1.0, <2.2.0'
                                - '>=2.4.0, <2.4.9'
                                - '>=2.5.0, <2.5.4'
                                - '>=2.2.0, <2.3.0'
                                - '>=2, <2.1.0'
                            publicationTime: 2014-07-25T22:18:02Z
                            disclosureTime: 2014-07-25T22:18:02Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2014-4931
                              CWE:
                                - CWE-94
                            credit:
                              - Jeremy Derussé
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
                            cvssScore: 5.6
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70211
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70211
                            title: Denial of Service (DoS)
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Denial of Service (DoS).


                              ## Details

                              Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                              Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                              One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                              When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                              Two common types of DoS vulnerabilities:



                              * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                              * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.19, 2.4.9, 2.5.4 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2014-5244-denial-of-service-with-a-malicious-http-host-header)

                              - [GitHub PR](https://github.com/symfony/symfony/pull/11828)

                              - [GitHub Commit](https://github.com/symfony/symfony/commit/1ee96a8b1b0987ffe2a62dca7ad268bf9edfa9b8)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2, <2.3.19'
                                - '>=2.4.0, <2.4.9'
                                - '>=2.5.0, <2.5.4'
                            publicationTime: 2014-09-03T07:37:21Z
                            disclosureTime: 2014-09-03T07:37:21Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2014-5244
                              CWE:
                                - CWE-400
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 5.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70212
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70212
                            title: Information Exposure
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Information Exposure.


                              When you enable the ESI feature and when you are using a proxy like Varnish that you configured as a trusted proxy, the FragmentHandler considered requests to render fragments as coming from a trusted source, even if the client was requesting them directly. Symfony can not distinguish between ESI requests done on behalf of the client by Varnish and faked fragment requests coming directly from the client.


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2014-5245-direct-access-of-esi-urls-behind-a-trusted-proxy)

                              - [GitHub PR](https://github.com/symfony/symfony/pull/11831)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: low
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.19'
                                - '>=2.1.0, <2.2.0'
                                - '>=2.4.0, <2.4.9'
                                - '>=2.5.0, <2.5.4'
                                - '>=2.2.0, <2.3.0'
                                - '>=2, <2.1.0'
                            publicationTime: 2014-09-03T07:40:02Z
                            disclosureTime: 2014-09-03T07:40:02Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2014-5245
                              CWE:
                                - CWE-200
                            credit:
                              - Cédric Nirousset
                              - Trent Steel
                              - Christophe Coevoet
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 3.7
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70213
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70213
                            title: Authentication Bypass
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Authentication Bypass.


                              When an application uses an HTTP basic or digest authentication, Symfony does not parse the Authorization header properly, which could be exploited in some server setups (no exploits have been demonstrated though.)


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2014-6061-security-issue-when-parsing-the-authorization-header)

                              - [GitHub Issue](https://github.com/symfony/symfony/pull/11829)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: low
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.19'
                                - '>=2.1.0, <2.2.0'
                                - '>=2.4.0, <2.4.9'
                                - '>=2.5.0, <2.5.4'
                                - '>=2.2.0, <2.3.0'
                                - '>=2, <2.1.0'
                            publicationTime: 2014-09-03T07:38:23Z
                            disclosureTime: 2014-09-03T07:38:23Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2014-6061
                              CWE:
                                - CWE-592
                            credit:
                              - Damien Tournoud
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 3.7
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70214
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70214
                            title: Cross-site Request Forgery (CSRF)
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Cross-site Request Forgery (CSRF).


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2014-6072-csrf-vulnerability-in-the-web-profiler)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.19'
                                - '>=2.1.0, <2.2.0'
                                - '>=2.4.0, <2.4.9'
                                - '>=2.5.0, <2.5.4'
                                - '>=2.2.0, <2.3.0'
                                - '>=2, <2.1.0'
                            publicationTime: 2014-09-03T07:40:30Z
                            disclosureTime: 2014-09-03T07:40:30Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2014-6072
                              CWE:
                                - CWE-352
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
                            cvssScore: 6.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70215
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70215
                            title: Arbitrary Code Injection
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Arbitrary Code Injection.


                              Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a `language="php"` attribute of a SCRIPT element.


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.27, 2.6.6, 2.2.0, 2.5.0, 2.5.11, 2.3.0, 2.1.0 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2015-2308-esi-code-injection)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.27'
                                - '>=2.6.0, <2.6.6'
                                - '>=2.1.0, <2.2.0'
                                - '>=2.4.0, <2.5.0'
                                - '>=2.5.0, <2.5.11'
                                - '>=2.2.0, <2.3.0'
                                - '>=2, <2.1.0'
                            publicationTime: 2015-04-01T18:55:26Z
                            disclosureTime: 2015-04-01T18:55:26Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-2308
                              CWE:
                                - CWE-94
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
                            cvssScore: 6.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70216
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70216
                            title: Man-in-the-Middle (MitM)
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Man-in-the-Middle (MitM).


                              The `Symfony\Component\HttpFoundation\Request` class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middle attack between the latest trusted proxy and the web server.


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.27, 2.5.11, 2.6.6 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2015-2309-unsafe-methods-in-the-request-class)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2, <2.3.27'
                                - '>=2.4.0, <2.5.11'
                                - '>=2.6.0, <2.6.6'
                            publicationTime: 2015-04-01T18:55:26Z
                            disclosureTime: 2015-04-01T18:55:26Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-2309
                              CWE:
                                - CWE-300
                            credit:
                              - Dmitrii Chekaliuk
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
                            cvssScore: 6.5
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70218
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70218
                            title: Session Fixation
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Session Fixation.


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.35, 2.6.12, 2.5.0, 2.7.7, 2.6.0 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.35'
                                - '>=2.6.0, <2.6.12'
                                - '>=2.4.0, <2.5.0'
                                - '>=2.7.0, <2.7.7'
                                - '>=2.5.0, <2.6.0'
                            publicationTime: 2015-11-23T11:45:06Z
                            disclosureTime: 2015-11-23T11:45:06Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-8124
                              CWE:
                                - CWE-384
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
                            cvssScore: 6.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70219
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70219
                            title: Timing Attack
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Timing Attack.


                              Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving:

                              * Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or

                              * Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or

                              * legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.35, 2.6.12, 2.5.0, 2.7.7, 2.6.0 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.35'
                                - '>=2.6.0, <2.6.12'
                                - '>=2.4.0, <2.5.0'
                                - '>=2.7.0, <2.7.7'
                                - '>=2.5.0, <2.6.0'
                            publicationTime: 2015-11-23T11:45:06Z
                            disclosureTime: 2015-11-23T11:45:06Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-8125
                              CWE:
                                - CWE-208
                            credit:
                              - Sebastiaan Stok
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
                            cvssScore: 7.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70220
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70220
                            title: Insecure Randomness
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Insecure Randomness .


                              The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.37, 2.6.13, 2.5.0, 2.7.9, 2.6.0 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.37'
                                - '>=2.6.0, <2.6.13'
                                - '>=2.4.0, <2.5.0'
                                - '>=2.7.0, <2.7.9'
                                - '>=2.5.0, <2.6.0'
                            publicationTime: 2016-01-14T09:59:32Z
                            disclosureTime: 2016-01-14T09:59:32Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2016-1902
                              CWE:
                                - CWE-330
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
                            cvssScore: 7.5
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-70222
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70222
                            title: Denial of Service (DoS)
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Denial of Service (DoS).


                              The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.


                              ## Details

                              Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                              Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                              One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                              When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                              Two common types of DoS vulnerabilities:



                              * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                              * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                              ## Remediation

                              Upgrade `symfony/symfony` to version 2.3.41, 2.7.0, 2.5.0, 2.7.13, 2.6.0, 2.8.6, 3.0.6 or higher.


                              ## References

                              - [Symfony Release Notes](http://symfony.com/blog/cve-2016-4423-large-username-storage-in-session)

                              - [GitHub PR](https://github.com/symfony/symfony/pull/18733)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.41'
                                - '>=2.6.0, <2.7.0'
                                - '>=2.4.0, <2.5.0'
                                - '>=2.7.0, <2.7.13'
                                - '>=2.5.0, <2.6.0'
                                - '>=2.8.0, <2.8.6'
                                - '>=3, <3.0.6'
                            publicationTime: 2016-05-09T21:31:02Z
                            disclosureTime: 2016-05-09T21:31:02Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2016-4423
                              CWE:
                                - CWE-400
                            credit:
                              - Marek Alaksa
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                            cvssScore: 7.5
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-72196
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72196
                            title: Denial of Service (DoS)
                            type: vuln
                            description: >
                              ## Overview

                              [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.


                              Affected versions of this package are vulnerable to Denial of Service (DoS) attacks via the `PDOSessionHandler` class.


                              **An application is vulnerable when:**


                              * It uses `PDOSessionHandler` to store its sessions

                              * And it uses MySQL as a backend for sessions managed by `PDOSessionHandler`

                              * And the SQL mode does not contain `STRICT_ALL_TABLES` or `STRICT_TRANS_TABLES`.


                              With this configuration, An attacker may conduct a denial of service by a well-crafted session, which leads to an infinite loop in the code.


                              ## Details

                              Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                              Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                              One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                              When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                              Two common types of DoS vulnerabilities:



                              * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                              * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                              ## Remediation

                              Upgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.


                              ## References

                              - [Symphony Security Advisory](https://symfony.com/cve-2018-11386)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.7.48
                                - '>=2.8.0, <2.8.41'
                                - '>=3.0.0, <3.3.17'
                                - '>=3.4.0, <3.4.11'
                                - '>=4.0.0, <4.0.11'
                            publicationTime: 2018-05-30T11:36:38.154000Z
                            disclosureTime: 2018-05-30T03:25:45.531000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-11386
                              CWE:
                                - CWE-835
                            credit:
                              - Federico Stange
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
                            cvssScore: 5.9
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-72197
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72197
                            title: Access Restriction Bypass
                            type: vuln
                            description: >
                              ## Overview

                              [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of PHP components.


                              Affected versions of this package are vulnerable to Access Restriction Bypass. A misconfigured LDAP server allowed unauthorized access, due to a missing check for `null` passwords.


                              **Note:** This is related to [CVE-2016-2403](https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70221).


                              ## Remediation

                              Upgrade `symfony/symfony` to versions 2.8.37, 3.3.17, 3.4.7, 4.0.7 or higher.


                              ## References

                              - [Symphony Security Advisory](https://symfony.com/cve-2018-11407)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: critical
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.8.37
                                - '>=3.0.0, <3.3.17'
                                - '>=3.4.0, <3.4.7'
                                - '>=4.0.0, <4.0.7'
                            publicationTime: 2018-05-30T11:36:38.236000Z
                            disclosureTime: 2018-05-30T03:25:45.532000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-11407
                              CWE:
                                - CWE-284
                            credit:
                              - Theo Bouge
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 9.8
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-72198
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72198
                            title: CSRF Token Fixation
                            type: vuln
                            description: >
                              ## Overview

                              [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.


                              Affected versions of this package are vulnerable to CSRF Token Fixation. CSRF tokens where not erased during logout, when the `invalidate_session` option was disabled. By default, a user’s session is invalidated when the user is logged out.


                              ## Remediation

                              Upgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.


                              ## References

                              - [Symphony Security Advisory](https://symfony.com/cve-2018-11406)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.7.48
                                - '>=2.8.0, <2.8.41'
                                - '>=3.0.0, <3.3.17'
                                - '>=3.4.0, <3.4.11'
                                - '>=4.0.0, <4.0.11'
                            publicationTime: 2018-05-30T11:36:38.318000Z
                            disclosureTime: 2018-05-30T03:25:45.533000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-11406
                              CWE:
                                - CWE-384
                            credit:
                              - Kevin Liagre
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
                            cvssScore: 8.8
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-72199
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72199
                            title: Open Redirect
                            type: vuln
                            description: >
                              ## Overview

                              [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.


                              Affected versions of this package are vulnerable to Open Redirect. This is due to an incomplete fix for [CVE-2017-16652](https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70381). There was an an edge case when the `security.http_utils` was inlined by the container.


                              ## Remediation

                              Upgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.


                              ## References

                              - [Symphony Security Advisory](https://symfony.com/cve-2018-11408)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.7.48
                                - '>=2.8.0, <2.8.41'
                                - '>=3.0.0, <3.3.17'
                                - '>=3.4.0, <3.4.11'
                                - '>=4.0.0, <4.0.11'
                            publicationTime: 2018-05-30T11:36:38.403000Z
                            disclosureTime: 2018-05-30T03:25:45.535000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-11408
                              CWE:
                                - CWE-601
                            credit:
                              - Antal Aron
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
                            cvssScore: 6.1
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-72200
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72200
                            title: Session Fixation
                            type: vuln
                            description: >
                              ## Overview

                              [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.


                              Affected versions of this package are vulnerable to Session Fixation via the `Guard` login feature. An attacker may be able to impersonate the victim towards the web application if the session id value was previously known to the attacker. This allows the attacker to access a Symfony web application with the attacked user's permissions.


                              **Note:**

                              * The `Guard authentication` login feature must be enabled for the attack to be applicable.

                              * The attacker must have access to the `PHPSESSID` cookie value or has successfully set a new value in the user's browser.


                              ## Remediation

                              Upgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.


                              ## References

                              - [Symphony Security Advisory](https://symfony.com/cve-2018-11385)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.7.48
                                - '>=2.8.0, <2.8.41'
                                - '>=3.0.0, <3.3.17'
                                - '>=3.4.0, <3.4.11'
                                - '>=4.0.0, <4.0.11'
                            publicationTime: 2018-05-30T11:36:38.526000Z
                            disclosureTime: 2018-05-30T03:25:45.536000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-11385
                              CWE:
                                - CWE-384
                            credit:
                              - Chris Wilkinson
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 8.1
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-SYMFONYSYMFONY-72246
                            url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72246
                            title: Cross-site Scripting (XSS)
                            type: vuln
                            description: "## Overview\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is the The Symfony PHP framework.\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks via the `ExceptionHandler.php` method.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `symfony/symfony` to versions 2.7.33, 2.8.26, 3.2.13, 3.3.6 or higher.\n\n## References\n- [GitHub PR](https://github.com/symfony/symfony/pull/23684)\n- [GitHub Issue](https://github.com/symfony/symfony/issues/27987)\n"
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                            package: symfony/symfony
                            version: 2.3.1
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.7.33
                                - '>=2.8.0, <2.8.26'
                                - '>=3.0.0, <3.2.13'
                                - '>=3.3.0, <3.3.6'
                            publicationTime: 2018-07-30T13:57:42.005000Z
                            disclosureTime: 2018-07-20T00:54:33.251000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2017-18343
                              CWE:
                                - CWE-79
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
                            cvssScore: 6.1
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-TWIGTWIG-173776
                            url: https://snyk.io/vuln/SNYK-PHP-TWIGTWIG-173776
                            title: Information Exposure
                            type: vuln
                            description: >
                              ## Overview


                              [twig/twig](https://packagist.org/packages/twig/twig) is a flexible, fast, and secure template language for PHP.



                              Affected versions of this package are vulnerable to Information Exposure

                              due to allowing the evaluation of non-trusted templates in a sandbox, where everything is forbidden if not explicitly allowed by a sandbox policy (tags, filters, functions, method calls, ...).



                              *Note: If you are not using the sandbox, your code is not affected.*


                              ## Remediation


                              Upgrade `twig/twig` to version 1.38.0, 2.7.0 or higher.



                              ## References


                              - [GitHub Commit](https://github.com/twigphp/Twig/commit/0f3af98ef6e71929ad67fb6e5f3ad65777c1c4c5)


                              - [Twig Security Advisory](https://symfony.com/blog/twig-sandbox-information-disclosure)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                              - twig/twig@1.35.0
                            package: twig/twig
                            version: 1.35.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=1.0.0, <1.38.0'
                                - '>=2.0.0, <2.7.0'
                            publicationTime: 2019-03-12T13:58:49Z
                            disclosureTime: 2019-03-12T13:58:49Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2019-9942
                              CWE:
                                - CWE-200
                            credit:
                              - Fabien Potencier
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/RL:O
                            cvssScore: 4.8
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-TWIGTWIG-72239
                            url: https://snyk.io/vuln/SNYK-PHP-TWIGTWIG-72239
                            title: Server Side Template Injection (SSTI)
                            type: vuln
                            description: >
                              ## Overview

                              [twig/twig](https://packagist.org/packages/twig/twig) is a flexible, fast, and secure template language for PHP.


                              Affected versions of this package are vulnerable to Server Side Template Injection (SSTI) via the `search_key` parameter.


                              ## Remediation

                              Upgrade `twig/twig` to version 2.4.4 or higher.


                              ## References

                              - [Exploit-DB](https://www.exploit-db.com/exploits/44102/)

                              - [GitHub Commit](https://github.com/twigphp/Twig/commit/eddb97148ad779f27e670e1e3f19fb323aedafeb)

                              - [GitHub ChangLog](https://github.com/twigphp/Twig/blob/2.x/CHANGELOG)
                            functions: []
                            from:
                              - symfony/symfony@2.3.1
                              - twig/twig@1.35.0
                            package: twig/twig
                            version: 1.35.0
                            severity: critical
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.4.4
                            publicationTime: 2018-07-23T13:46:08.115000Z
                            disclosureTime: 2018-07-10T15:06:02.373000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2018-13818
                              CWE:
                                - CWE-94
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                            cvssScore: 9.8
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-YIISOFTYII-70295
                            url: https://snyk.io/vuln/SNYK-PHP-YIISOFTYII-70295
                            title: Arbitrary Code Execution
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`yiisoft/yii`](https://packagist.org/packages/yiisoft/yii) are vulnerable to Arbitrary Code Execution.


                              The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.


                              ## Remediation

                              Upgrade `yiisoft/yii` to version 1.1.15 or higher.


                              ## References

                              - [Yii Framework Security Advisory](http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/)
                            functions: []
                            from:
                              - yiisoft/yii@1.1.14
                            package: yiisoft/yii
                            version: 1.1.14
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <1.1.15
                            publicationTime: 2014-06-30T07:15:00Z
                            disclosureTime: 2014-06-30T07:15:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2014-4672
                              CWE:
                                - CWE-94
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
                            cvssScore: 7.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70321
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70321
                            title: Route Parameter Injection
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Route Parameter Injection.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.1.4, 2.0.8 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-01)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.1.0, <2.1.4'
                                - '>=2, <2.0.8'
                            publicationTime: 2013-03-13T08:39:38Z
                            disclosureTime: 2013-03-13T08:39:38Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-74
                            credit:
                              - codemagician
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
                            cvssScore: 6.5
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70322
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70322
                            title: Information Exposure
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Information Exposure.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.1.4, 2.0.8 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-02)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: low
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.1.0, <2.1.4'
                                - '>=2, <2.0.8'
                            publicationTime: 2013-03-13T15:05:23Z
                            disclosureTime: 2013-03-13T15:05:23Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-200
                            credit:
                              - Pádraic Brady
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 3.7
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70323
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70323
                            title: SQL Injection
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to SQL Injection due to execution of platform-specific SQL containing interpolations.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.1.4, 2.0.8 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-03)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.1.0, <2.1.4'
                                - '>=2, <2.0.8'
                            publicationTime: 2013-03-13T15:04:50Z
                            disclosureTime: 2013-03-13T15:04:50Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-89
                            credit:
                              - Axel Helmert
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
                            cvssScore: 6.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70324
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70324
                            title: IP Spoofing
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Potential IP Spoofing.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.2.5 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-04)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.2.5
                            publicationTime: 2013-10-31T10:35:17Z
                            disclosureTime: 2013-10-31T10:35:17Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-290
                            credit:
                              - Steve Talbot
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
                            cvssScore: 5.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70325
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70325
                            title: XML External Entity (XXE) Injection
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to XML External Entity (XXE) Injection.


                              ## Details


                              XXE Injection is a type of attack against an application that parses XML input.

                              XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.



                              Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.



                              For example, below is a sample XML document, containing an XML element- username.



                              ```xml

                              <?xml version="1.0" encoding="ISO-8859-1"?>

                                 <username>John</username>

                              </xml>

                              ```



                              An external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.



                              ```xml

                              <?xml version="1.0" encoding="ISO-8859-1"?>

                              <!DOCTYPE foo [

                                 <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>

                                 <username>&xxe;</username>

                              </xml>

                              ```



                              Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.1.6, 2.2.6 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-01)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.1.0, <2.1.6'
                                - '>=2.2.0, <2.2.6'
                            publicationTime: 2014-02-26T16:02:02Z
                            disclosureTime: 2014-02-26T16:02:02Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-611
                            credit:
                              - Lukas Reschke
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
                            cvssScore: 7.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70326
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70326
                            title: Cross-site Scripting (XSS)
                            type: vuln
                            description: "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Cross-site Scripting (XSS).\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.3.1, 2.2.7 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-03)\n"
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.1'
                                - '>=2, <2.2.7'
                            publicationTime: 2014-02-26T16:02:02Z
                            disclosureTime: 2014-02-26T16:02:02Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-79
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
                            cvssScore: 6.5
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70327
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70327
                            title: Authentication Bypass
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Authentication Bypass.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.3.3, 2.2.8 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-05)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.3'
                                - '>=2, <2.2.8'
                            publicationTime: 2014-09-16T22:00:00Z
                            disclosureTime: 2014-09-16T22:00:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2014-8088
                              CWE:
                                - CWE-592
                            credit:
                              - Matthew Daley
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
                            cvssScore: 5.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70328
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70328
                            title: SQL Injection
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to SQL Injection vector when manually quoting values for sqlsrv extension, using null byte.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.3.3, 2.2.8 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-06)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.3'
                                - '>=2, <2.2.8'
                            publicationTime: 2014-09-16T22:00:00Z
                            disclosureTime: 2014-09-16T22:00:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2014-8089
                              CWE:
                                - CWE-89
                            credit:
                              - Jonas Sandström
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
                            cvssScore: 6.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70329
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70329
                            title: Insufficient Session Validation
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Insufficient Session Validation.


                              `Zend\Session` session validators do not work as expected if set prior to the start of a session.


                              The implication is that subsequent calls to `Zend\Session\SessionManager#start()` (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid.


                              An attacker is thus able to simply ignore session validators such as `RemoteAddr` or `HttpUserAgent`, since the "signature" that these validators check against is not being stored in the session.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.3.4, 2.2.9 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-01)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.4'
                                - '>=2, <2.2.9'
                            publicationTime: 2015-01-14T22:00:00Z
                            disclosureTime: 2015-01-14T22:00:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-284
                            credit:
                              - Yuriy Dyachenko
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 5.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70330
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70330
                            title: SQL Injection
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to SQL Injection.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.3.5, 2.2.10 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-02)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2.3.0, <2.3.5'
                                - '>=2, <2.2.10'
                            publicationTime: 2015-02-18T19:15:09Z
                            disclosureTime: 2015-02-18T19:15:09Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-0270
                              CWE:
                                - CWE-89
                            credit:
                              - Grigory Ivanov
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
                            cvssScore: 6.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70332
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70332
                            title: CRLF Injection
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Potential CRLF injection attacks in mail and HTTP headers.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.3.8, 2.4.1 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-04)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.3.8
                                - '>=2.4.0, <2.4.1'
                            publicationTime: 2015-05-07T08:53:42Z
                            disclosureTime: 2015-05-07T08:53:42Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-3154
                              CWE:
                                - CWE-113
                            credit:
                              - Filippo Tessarotto
                              - Maks3w
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
                            cvssScore: 5.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70333
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70333
                            title: XML External Entity (XXE) Injection
                            type: vuln
                            description: >-
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to XML External Entity (XXE) Injection.



                              ## Details



                              XXE Injection is a type of attack against an application that parses XML input.

                              XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.



                              Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.



                              For example, below is a sample XML document, containing an XML element- username.



                              ```xml

                              <?xml version="1.0" encoding="ISO-8859-1"?>

                                 <username>John</username>

                              </xml>

                              ```



                              An external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.



                              ```xml

                              <?xml version="1.0" encoding="ISO-8859-1"?>

                              <!DOCTYPE foo [

                                 <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>

                                 <username>&xxe;</username>

                              </xml>

                              ```



                              Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.



                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.4.6, 2.5.1 or higher.



                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-06)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: proof-of-concept
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.4.6
                                - '>=2.5.0, <2.5.1'
                            publicationTime: 2015-08-03T15:13:58Z
                            disclosureTime: 2015-08-03T15:13:58Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-5161
                              CWE:
                                - CWE-611
                            credit:
                              - Dawid Golunski
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:R
                            cvssScore: 6.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70335
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70335
                            title: Information Exposure
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Information Exposure.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.4.9 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-09)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: low
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.4.9
                            publicationTime: 2015-11-23T14:30:00Z
                            disclosureTime: 2015-11-23T14:30:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-200
                            credit:
                              - Vincent Herbulot
                            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 3.7
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70336
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70336
                            title: Information Exposure
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Information Exposure.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.4.9 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-10)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - '>=2, <2.4.9'
                            publicationTime: 2015-11-23T14:30:00Z
                            disclosureTime: 2015-11-23T14:30:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE:
                                - CVE-2015-7503
                              CWE:
                                - CWE-200
                            credit:
                              - Unknown
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
                            cvssScore: 7.5
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70337
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70337
                            title: Arbitrary Code Execution
                            type: vuln
                            description: >
                              ## Overview

                              Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Arbitrary Code Execution.


                              ## Remediation

                              Upgrade `zendframework/zendframework` to version 2.4.11 or higher.


                              ## References

                              - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2016-04)
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: high
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.4.11
                            publicationTime: 2016-12-19T15:29:00Z
                            disclosureTime: 2016-12-19T15:29:00Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-94
                            credit:
                              - Dawid Golunski
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
                            cvssScore: 7.3
                            patches: []
                            upgradePath: []
                          - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-72268
                            url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-72268
                            title: Arbitrary URL Rewrite
                            type: vuln
                            description: "## Overview\n[zendframework/zendframework](https://packagist.org/packages/zendframework/zendframework) provides functionality for consuming RSS and Atom feeds.\n\nAffected versions of this package are vulnerable to Arbitrary URL Rewrite. The request URI marshaling process contains logic that inspects HTTP request headers that are specific to a given server-side URL rewrite mechanism. \n\nWhen these headers are present on systems not running the specific URL rewriting mechanism, the URLs are subject to rewriting, allowing a malicious client or proxy to emulate the headers to request arbitrary content.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.5.0 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2018-01)\n"
                            functions: []
                            from:
                              - zendframework/zendframework@2.1.0
                            package: zendframework/zendframework
                            version: 2.1.0
                            severity: medium
                            exploitMaturity: no-known-exploit
                            language: php
                            packageManager: composer
                            semver:
                              vulnerable:
                                - <2.5.0
                            publicationTime: 2018-08-15T08:34:54.643000Z
                            disclosureTime: 2018-08-02T16:29:46.707000Z
                            isUpgradable: false
                            isPatchable: false
                            isPinnable: false
                            identifiers:
                              CVE: []
                              CWE:
                                - CWE-601
                            credit:
                              - Drupal Security Team
                            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
                            cvssScore: 5.3
                            patches: []
                            upgradePath: []
                        licenses: []
                      dependencyCount: 31
                      org:
                        name: atokeneduser
                        id: 4a18d42f-0706-4ad0-b127-24078731fbed
                      licensesPolicy: null
                      packageManager: composer
      deprecated: false
  /test/dep-graph:
    post:
      tags:
        - Test
      summary: Test Dep Graph
      description: >-
        Test for issues in a [Snyk dependency graph](https://github.com/snyk/dep-graph).


        Experimental! Note these endpoints are subject to change and only available to selected users. Please

        contact [support@snyk.io](mailto:support@snyk.io) to request access.


        The following package managers are supported:


        * deb


        * gomodules


        * gradle


        * maven


        * nuget


        * paket


        * pip


        * rpm


        * rubygems


        * cocoapods


        * npm


        * yarnUse this endpoint to find issues in a [DepGraph data object](https://github.com/snyk/dep-graph#depgraphdata).


        #### Required permissions


        - `View Organization`


        - `View Project`


        - `View Project Snapshot`


        - `Test Project`
      operationId: TestDepGraph
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/graphrequestpayload'
                - example:
                    depGraph:
                      schemaVersion: 1.2.0
                      pkgManager:
                        name: maven
                      pkgs:
                        - id: app@1.0.0
                          info:
                            name: app
                            version: 1.0.0
                        - id: ch.qos.logback:logback-core@1.0.13
                          info:
                            name: ch.qos.logback:logback-core
                            version: 1.0.13
                      graph:
                        rootNodeId: root-node
                        nodes:
                          - nodeId: root-node
                            pkgId: app@1.0.0
                            deps:
                              - nodeId: ch.qos.logback:logback-core@1.0.13
                          - nodeId: ch.qos.logback:logback-core@1.0.13
                            pkgId: ch.qos.logback:logback-core@1.0.13
                            deps: []
            example:
              depGraph:
                schemaVersion: 1.2.0
                pkgManager:
                  name: maven
                pkgs:
                  - id: app@1.0.0
                    info:
                      name: app
                      version: 1.0.0
                  - id: ch.qos.logback:logback-core@1.0.13
                    info:
                      name: ch.qos.logback:logback-core
                      version: 1.0.13
                graph:
                  rootNodeId: root-node
                  nodes:
                    - nodeId: root-node
                      pkgId: app@1.0.0
                      deps:
                        - nodeId: ch.qos.logback:logback-core@1.0.13
                    - nodeId: ch.qos.logback:logback-core@1.0.13
                      pkgId: ch.qos.logback:logback-core@1.0.13
                      deps: []
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/TestDepGraphresponse'
                  - example:
                      ok: false
                      packageManager: maven
                      issuesData:
                        SNYK-JAVA-CHQOSLOGBACK-30208:
                          CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
                          credit:
                            - Unknown
                          cvssScore: 9.8
                          description: "## Overview\n\n[ch.qos.logback:logback-core](https://mvnrepository.com/artifact/ch.qos.logback/logback-core) is a logback-core module.\n\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution.\nA configuration can be turned on to allow remote logging through interfaces that accept untrusted serialized data. Authenticated attackers on the adjacent network can exploit this vulnerability to run arbitrary code through the deserialization of custom gadget chains.\n\n## Details\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\r\n\r\n  \r\n\r\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.\r\n\r\n  \r\n\r\nJava deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a [popular library (Apache Commons Collection)](https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.\r\n\r\n  \r\n\r\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\r\n\r\n  \r\n\r\n> Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).\r\n\r\n- Apache Blog\r\n\r\n  \r\n\r\nThe vulnerability, also know as _Mad Gadget_\r\n\r\n> Mad Gadget is one of the most pernicious vulnerabilities we’ve seen. By merely existing on the Java classpath, seven “gadget” classes in Apache Commons Collections (versions 3.0, 3.1, 3.2, 3.2.1, and 4.0) make object deserialization for the entire JVM process Turing complete with an exec function. Since many business applications use object deserialization to send messages across the network, it would be like hiring a bank teller who was trained to hand over all the money in the vault if asked to do so politely, and then entrusting that teller with the key. The only thing that would keep a bank safe in such a circumstance is that most people wouldn’t consider asking such a question.\r\n\r\n- Google\n\n## Remediation\n\nUpgrade `ch.qos.logback:logback-core` to version 1.1.11 or higher.\n\n\n## References\n\n- [Logback News](https://logback.qos.ch/news.html)\n\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5929/)\n"
                          disclosureTime: 2017-03-13T06:59:00Z
                          fixedIn:
                            - 1.1.11
                          id: SNYK-JAVA-CHQOSLOGBACK-30208
                          identifiers:
                            CVE:
                              - CVE-2017-5929
                            CWE:
                              - CWE-502
                          language: java
                          mavenModuleName:
                            artifactId: logback-core
                            groupId: ch.qos.logback
                          moduleName: ch.qos.logback:logback-core
                          packageManager: maven
                          packageName: ch.qos.logback:logback-core
                          patches: []
                          semver:
                            vulnerable:
                              - '[, 1.1.11)'
                          severity: critical
                          title: Arbitrary Code Execution
                      issues:
                        - pkgName: ch.qos.logback:logback-core
                          pkgVersion: 1.0.13
                          issueId: SNYK-JAVA-CHQOSLOGBACK-30208
                          fixInfo: {}
                      org:
                        name: atokeneduser
                        id: 4a18d42f-0706-4ad0-b127-24078731fbed
      deprecated: false
  /monitor/dep-graph:
    post:
      tags:
        - Monitor
      summary: Monitor Dep Graph
      description: >-
        Experimental! Note these endpoints are subject to change and only available to selected users. Please

        contact [support@snyk.io](mailto:support@snyk.io) to request access.


        The following package managers are supported:


        * deb


        * gomodules


        * gradle


        * maven


        * nuget


        * paket


        * pip


        * rpm


        * rubygems


        * cocoapods


        * npm


        * yarn


        The name of the root node in the dep-graph is used as the project name when creating a project. This should

        be unique for your organization. In the example given below 'my-maven-app' will be the project name.


        To inform Snyk that some dependencies in your project have changed ensure subsequent requests use the same root node

        name.Use this endpoint to monitor a [DepGraph data object](https://github.com/snyk/dep-graph#depgraphdata).


        #### Required permissions


        - `View Organization`


        - `Add Project`


        - `Test Project`
      operationId: MonitorDepGraph
      parameters:
        - name: org
          in: query
          description: The organization to test the package with. See "The Snyk organization for a request" above.
          style: form
          explode: true
          schema:
            type: string
            example: 9695cbb1-3a87-4d6f-8ae1-61a1c37ee9f7
        - name: prune-dep-graph
          in: query
          description: Will prune large dep-graphs by removing identical sub-graphs under a top level dependency. If you receive a 422 error, it's likely that your dep-graph is too large to monitor. Pruning can help reduce the number of repetative paths but still retain at least one fully resolved path to ensure vulnerablities are not missed.
          style: form
          explode: true
          schema:
            type: boolean
            example: true
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/monitorgraphpayload'
                - example:
                    depGraph:
                      schemaVersion: 1.2.0
                      pkgManager:
                        name: maven
                      pkgs:
                        - id: my-maven-app@1.0.0
                          info:
                            name: my-maven-app
                            version: 1.0.0
                        - id: ch.qos.logback:logback-core@1.0.13
                          info:
                            name: ch.qos.logback:logback-core
                            version: 1.0.13
                      graph:
                        rootNodeId: root-node
                        nodes:
                          - nodeId: root-node
                            pkgId: my-maven-app@1.0.0
                            deps:
                              - nodeId: ch.qos.logback:logback-core@1.0.13
                          - nodeId: ch.qos.logback:logback-core@1.0.13
                            pkgId: ch.qos.logback:logback-core@1.0.13
                            deps: []
            example:
              depGraph:
                schemaVersion: 1.2.0
                pkgManager:
                  name: maven
                pkgs:
                  - id: my-maven-app@1.0.0
                    info:
                      name: my-maven-app
                      version: 1.0.0
                  - id: ch.qos.logback:logback-core@1.0.13
                    info:
                      name: ch.qos.logback:logback-core
                      version: 1.0.13
                graph:
                  rootNodeId: root-node
                  nodes:
                    - nodeId: root-node
                      pkgId: my-maven-app@1.0.0
                      deps:
                        - nodeId: ch.qos.logback:logback-core@1.0.13
                    - nodeId: ch.qos.logback:logback-core@1.0.13
                      pkgId: ch.qos.logback:logback-core@1.0.13
                      deps: []
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/MonitorDepGraphresponse'
                  - example:
                      ok: true
                      id: f7c065cd-5850-462d-a0ca-9719d07e3e38
                      uri: https://app.snyk.io/org/my-org/project/f7c065cd-5850-462d-a0ca-9719d07e3e38/history/39d14036-31f3-4f22-8037-1d979e0516ef
      deprecated: false
  /reporting/issues/latest:
    post:
      tags:
        - Reporting API
      summary: Get list of latest issues
      description: >-
        Returns issues currently in existence. This data can take up to 9 hours to refresh

        #### Required permissions


        - `View Project` for every Organization in `filters.orgs`


        - `View Organization Reports` for every Organization in `filters.orgs`
      operationId: Getlistoflatestissues
      parameters:
        - name: page
          in: query
          description: The page of results to request
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 1
        - name: perPage
          in: query
          description: 'The number of results to return per page (Maximum: 1000)'
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 100
        - name: sortBy
          in: query
          description: The key to sort results by
          style: form
          explode: true
          schema:
            allOf:
              - $ref: '#/components/schemas/sortBy2'
              - description: The key to sort results by
                example: issueTitle
        - name: order
          in: query
          description: The direction to sort results.
          style: form
          explode: true
          schema:
            type: string
            example: asc
        - name: groupBy
          in: query
          description: Set to issue to group the same issue in multiple projects
          style: form
          explode: true
          schema:
            allOf:
              - $ref: '#/components/schemas/groupBy'
              - description: Set to issue to group the same issue in multiple projects
                example: issue
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/IssuesFilters'
                - example:
                    filters:
                      orgs: []
                      severity:
                        - critical
                        - high
                        - medium
                        - low
                      exploitMaturity:
                        - mature
                        - proof-of-concept
                        - no-known-exploit
                        - no-data
                      types:
                        - vuln
                        - license
                        - configuration
                      languages:
                        - node
                        - javascript
                        - ruby
                        - java
                        - scala
                        - python
                        - golang
                        - php
                        - dotnet
                        - swift-objective-c
                        - elixir
                        - docker
                        - linux
                        - dockerfile
                      projects: []
                      issues: []
                      identifier: ''
                      ignored: false
                      patched: false
                      fixable: false
                      isFixed: false
                      isUpgradable: false
                      isPatchable: false
                      isPinnable: false
                      priorityScore:
                        min: 0
                        max: 1000
            example:
              filters:
                orgs: []
                severity:
                  - critical
                  - high
                  - medium
                  - low
                exploitMaturity:
                  - mature
                  - proof-of-concept
                  - no-known-exploit
                  - no-data
                types:
                  - vuln
                  - license
                  - configuration
                languages:
                  - node
                  - javascript
                  - ruby
                  - java
                  - scala
                  - python
                  - golang
                  - php
                  - dotnet
                  - swift-objective-c
                  - elixir
                  - docker
                  - linux
                  - dockerfile
                projects: []
                issues: []
                identifier: ''
                ignored: false
                patched: false
                fixable: false
                isFixed: false
                isUpgradable: false
                isPatchable: false
                isPinnable: false
                priorityScore:
                  min: 0
                  max: 1000
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Issues'
        '400':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/ErrorResponse'
                  - example:
                      code: 400
                      ok: false
                      error:
                        name: ValidationError
                        innerErrors:
                          - invalid type filters.types is an invalid type unsupported-type
              example:
                code: 400
                ok: false
                error:
                  name: ValidationError
                  innerErrors:
                    - invalid type filters.types is an invalid type unsupported-type
      deprecated: false
  /reporting/issues:
    post:
      tags:
        - Reporting API
      summary: Get list of issues
      description: >-
        Returns any issues that are present during the specified timeframe. For example, if an issue from 2018 is still considered a vulnerable today, it will show up in all reports from its inception to the current day. This data can take up to 9 hours to refresh.**Note:** A vulnerability that was introduced and then resolved on the same day will not show up in the response.


        #### Required permissions


        - `View Project` for every Organization in `filters.orgs`


        - `View Organization Reports` for every Organization in `filters.orgs`
      operationId: Getlistofissues
      parameters:
        - name: from
          in: query
          description: The date you wish to fetch results from, in the format `YYYY-MM-DD`
          required: true
          style: form
          explode: true
          schema:
            type: string
            example: 2017-07-01
        - name: to
          in: query
          description: The date you wish to fetch results until, in the format `YYYY-MM-DD`
          required: true
          style: form
          explode: true
          schema:
            type: string
            example: 2017-07-07
        - name: page
          in: query
          description: The page of results to request
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 1
        - name: perPage
          in: query
          description: 'The number of results to return per page (Maximum: 1000)'
          style: form
          explode: true
          schema:
            type: number
            format: double
            example: 100
        - name: sortBy
          in: query
          description: The key to sort results by
          style: form
          explode: true
          schema:
            allOf:
              - $ref: '#/components/schemas/sortBy2'
              - description: The key to sort results by
                example: issueTitle
        - name: order
          in: query
          description: The direction to sort results.
          style: form
          explode: true
          schema:
            type: string
            example: asc
        - name: groupBy
          in: query
          description: Set to issue to group the same issue in multiple projects
          style: form
          explode: true
          schema:
            allOf:
              - $ref: '#/components/schemas/groupBy'
              - description: Set to issue to group the same issue in multiple projects
                example: issue
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/IssuesFilters'
                - example:
                    filters:
                      orgs: []
                      severity:
                        - critical
                        - high
                        - medium
                        - low
                      exploitMaturity:
                        - mature
                        - proof-of-concept
                        - no-known-exploit
                        - no-data
                      types:
                        - vuln
                        - license
                        - configuration
                      languages:
                        - node
                        - javascript
                        - ruby
                        - java
                        - scala
                        - python
                        - golang
                        - php
                        - dotnet
                        - swift-objective-c
                        - elixir
                        - docker
                        - linux
                        - dockerfile
                      projects: []
                      issues: []
                      identifier: ''
                      ignored: false
                      patched: false
                      fixable: false
                      isFixed: false
                      isUpgradable: false
                      isPatchable: false
                      isPinnable: false
                      priorityScore:
                        min: 0
                        max: 1000
            example:
              filters:
                orgs: []
                severity:
                  - critical
                  - high
                  - medium
                  - low
                exploitMaturity:
                  - mature
                  - proof-of-concept
                  - no-known-exploit
                  - no-data
                types:
                  - vuln
                  - license
                  - configuration
                languages:
                  - node
                  - javascript
                  - ruby
                  - java
                  - scala
                  - python
                  - golang
                  - php
                  - dotnet
                  - swift-objective-c
                  - elixir
                  - docker
                  - linux
                  - dockerfile
                projects: []
                issues: []
                identifier: ''
                ignored: false
                patched: false
                fixable: false
                isFixed: false
                isUpgradable: false
                isPatchable: false
                isPinnable: false
                priorityScore:
                  min: 0
                  max: 1000
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Issues'
        '400':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/ErrorResponse'
                  - example:
                      code: 400
                      ok: false
                      error:
                        name: ValidationError
                        innerErrors:
                          - invalid type filters.types is an invalid type unsupported-type
              example:
                code: 400
                ok: false
                error:
                  name: ValidationError
                  innerErrors:
                    - invalid type filters.types is an invalid type unsupported-type
      deprecated: false
  /reporting/counts/issues/latest:
    post:
      tags:
        - Reporting API
      summary: Get latest issue counts
      description: >-
        Returns the number of issues currently in existence. This data can take up to 9 hours to refresh

        #### Required permissions


        - `View Project` for every Organization in `filters.orgs`


        - `View Organization Reports` for every Organization in `filters.orgs`
      operationId: Getlatestissuecounts
      parameters:
        - name: groupBy
          in: query
          description: The field to group results by
          style: form
          explode: true
          schema:
            allOf:
              - $ref: '#/components/schemas/groupBy2'
              - description: The field to group results by
                example: severity
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/IssueCountsFilters'
                - example:
                    filters:
                      orgs: []
                      severity:
                        - critical
                        - high
                        - medium
                        - low
                      types:
                        - vuln
                        - license
                        - configuration
                      languages:
                        - node
                        - javascript
                        - ruby
                        - java
                        - scala
                        - python
                        - golang
                        - php
                        - dotnet
                        - swift-objective-c
                        - elixir
                        - docker
                        - linux
                        - dockerfile
                      projects: []
                      ignored: false
                      patched: false
                      fixable: false
                      isUpgradable: false
                      isPatchable: false
                      isPinnable: false
                      priorityScore:
                        min: 0
                        max: 1000
            example:
              filters:
                orgs: []
                severity:
                  - critical
                  - high
                  - medium
                  - low
                types:
                  - vuln
                  - license
                  - configuration
                languages:
                  - node
                  - javascript
                  - ruby
                  - java
                  - scala
                  - python
                  - golang
                  - php
                  - dotnet
                  - swift-objective-c
                  - elixir
                  - docker
                  - linux
                  - dockerfile
                projects: []
                ignored: false
                patched: false
                fixable: false
                isUpgradable: false
                isPatchable: false
                isPinnable: false
                priorityScore:
                  min: 0
                  max: 1000
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/IssueCounts'
                  - example:
                      results:
                        - day: 2017-07-01
                          count: 0
                          severity:
                            critical: 0
                            high: 0
                            medium: 0
                            low: 0
              example:
                results:
                  - day: 2017-07-01
                    count: 0
                    severity:
                      critical: 0
                      high: 0
                      medium: 0
                      low: 0
        '400':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/ErrorResponse'
                  - example:
                      code: 400
                      ok: false
                      error:
                        name: ValidationError
                        innerErrors:
                          - invalid type filters.types is an invalid type unsupported-type
              example:
                code: 400
                ok: false
                error:
                  name: ValidationError
                  innerErrors:
                    - invalid type filters.types is an invalid type unsupported-type
      deprecated: false
  /reporting/counts/issues:
    post:
      tags:
        - Reporting API
      summary: Get issue counts
      description: >-
        Returns issue counts within a time frame. This data can take up to 9 hours to refresh

        #### Required permissions


        - `View Project` for every Organization in `filters.orgs`


        - `View Organization Reports` for every Organization in `filters.orgs`
      operationId: Getissuecounts
      parameters:
        - name: from
          in: query
          description: The date you wish to fetch results from, in the format `YYYY-MM-DD`
          required: true
          style: form
          explode: true
          schema:
            type: string
            example: 2017-07-01
        - name: to
          in: query
          description: The date you wish to fetch results until, in the format `YYYY-MM-DD`
          required: true
          style: form
          explode: true
          schema:
            type: string
            example: 2017-07-03
        - name: groupBy
          in: query
          description: The field to group results by
          style: form
          explode: true
          schema:
            allOf:
              - $ref: '#/components/schemas/groupBy2'
              - description: The field to group results by
                example: severity
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/IssueCountsFilters'
                - example:
                    filters:
                      orgs: []
                      severity:
                        - critical
                        - high
                        - medium
                        - low
                      types:
                        - vuln
                        - license
                        - configuration
                      languages:
                        - node
                        - javascript
                        - ruby
                        - java
                        - scala
                        - python
                        - golang
                        - php
                        - dotnet
                        - swift-objective-c
                        - elixir
                        - docker
                        - linux
                        - dockerfile
                      projects: []
                      ignored: false
                      patched: false
                      fixable: false
                      isUpgradable: false
                      isPatchable: false
                      isPinnable: false
                      priorityScore:
                        min: 0
                        max: 1000
            example:
              filters:
                orgs: []
                severity:
                  - critical
                  - high
                  - medium
                  - low
                types:
                  - vuln
                  - license
                  - configuration
                languages:
                  - node
                  - javascript
                  - ruby
                  - java
                  - scala
                  - python
                  - golang
                  - php
                  - dotnet
                  - swift-objective-c
                  - elixir
                  - docker
                  - linux
                  - dockerfile
                projects: []
                ignored: false
                patched: false
                fixable: false
                isUpgradable: false
                isPatchable: false
                isPinnable: false
                priorityScore:
                  min: 0
                  max: 1000
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/IssueCounts'
                  - example:
                      results:
                        - day: 2017-07-01
                          count: 0
                          severity:
                            critical: 0
                            high: 0
                            medium: 0
                            low: 0
                        - day: 2017-07-02
                          count: 0
                          severity:
                            critical: 0
                            high: 0
                            medium: 0
                            low: 0
                        - day: 2017-07-03
                          count: 0
                          severity:
                            critical: 0
                            high: 0
                            medium: 0
                            low: 0
              example:
                results:
                  - day: 2017-07-01
                    count: 0
                    severity:
                      critical: 0
                      high: 0
                      medium: 0
                      low: 0
                  - day: 2017-07-02
                    count: 0
                    severity:
                      critical: 0
                      high: 0
                      medium: 0
                      low: 0
                  - day: 2017-07-03
                    count: 0
                    severity:
                      critical: 0
                      high: 0
                      medium: 0
                      low: 0
        '400':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/ErrorResponse'
                  - example:
                      code: 400
                      ok: false
                      error:
                        name: ValidationError
                        innerErrors:
                          - invalid type filters.types is an invalid type unsupported-type
              example:
                code: 400
                ok: false
                error:
                  name: ValidationError
                  innerErrors:
                    - invalid type filters.types is an invalid type unsupported-type
      deprecated: false
  /reporting/counts/projects/latest:
    post:
      tags:
        - Reporting API
      summary: Get latest project counts
      description: >-
        Returns the number of projects currently in existence. This data can take up to 9 hours to refresh.


        + Params#### Required permissions


        - `View Project` for every Organization in `filters.orgs`


        - `View Organization Reports` for every Organization in `filters.orgs`
      operationId: Getlatestprojectcounts
      parameters: []
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/ProjectCountsFilters'
                - example:
                    filters:
                      orgs: []
                      languages:
                        - node
                        - javascript
                        - ruby
                        - java
                        - scala
                        - python
                        - golang
                        - php
                        - dotnet
                        - swift-objective-c
                        - elixir
                        - docker
                        - linux
                        - dockerfile
                      projects: []
            example:
              filters:
                orgs: []
                languages:
                  - node
                  - javascript
                  - ruby
                  - java
                  - scala
                  - python
                  - golang
                  - php
                  - dotnet
                  - swift-objective-c
                  - elixir
                  - docker
                  - linux
                  - dockerfile
                projects: []
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/ProjectCounts'
                  - example:
                      results:
                        - day: 2017-07-01
                          count: 0
              example:
                results:
                  - day: 2017-07-01
                    count: 0
        '400':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/ErrorResponse'
                  - example:
                      code: 400
                      ok: false
                      error:
                        name: ValidationError
                        innerErrors:
                          - invalid type filters.projects is an invalid project unsupported-project
              example:
                code: 400
                ok: false
                error:
                  name: ValidationError
                  innerErrors:
                    - invalid type filters.projects is an invalid project unsupported-project
      deprecated: false
  /reporting/counts/projects:
    post:
      tags:
        - Reporting API
      summary: Get project counts
      description: >-
        Returns project counts within a time frame. This data can take up to 9 hours to refresh

        #### Required permissions


        - `View Project` for every Organization in `filters.orgs`


        - `View Organization Reports` for every Organization in `filters.orgs`
      operationId: Getprojectcounts
      parameters:
        - name: from
          in: query
          description: The date you wish to fetch results from, in the format `YYYY-MM-DD`
          required: true
          style: form
          explode: true
          schema:
            type: string
            example: 2017-07-01
        - name: to
          in: query
          description: The date you wish to fetch results until, in the format `YYYY-MM-DD`
          required: true
          style: form
          explode: true
          schema:
            type: string
            example: 2017-07-03
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/ProjectCountsFilters'
                - example:
                    filters:
                      orgs: []
                      languages:
                        - node
                        - javascript
                        - ruby
                        - java
                        - scala
                        - python
                        - golang
                        - php
                        - dotnet
                        - swift-objective-c
                        - elixir
                        - docker
                        - linux
                        - dockerfile
                      projects: []
            example:
              filters:
                orgs: []
                languages:
                  - node
                  - javascript
                  - ruby
                  - java
                  - scala
                  - python
                  - golang
                  - php
                  - dotnet
                  - swift-objective-c
                  - elixir
                  - docker
                  - linux
                  - dockerfile
                projects: []
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/ProjectCounts'
                  - example:
                      results:
                        - day: 2017-07-01
                          count: 0
                        - day: 2017-07-02
                          count: 0
                        - day: 2017-07-03
                          count: 0
              example:
                results:
                  - day: 2017-07-01
                    count: 0
                  - day: 2017-07-02
                    count: 0
                  - day: 2017-07-03
                    count: 0
        '400':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/ErrorResponse'
                  - example:
                      code: 400
                      ok: false
                      error:
                        name: ValidationError
                        innerErrors:
                          - invalid type filters.projects is an invalid project unsupported-project
              example:
                code: 400
                ok: false
                error:
                  name: ValidationError
                  innerErrors:
                    - invalid type filters.projects is an invalid project unsupported-project
      deprecated: false
  /reporting/counts/tests:
    post:
      tags:
        - Reporting API
      summary: Get test counts
      description: >-
        Returns the number of tests conducted within a time frame. This data is updated in real time

        #### Required permissions


        - `View Project` for every Organization in `filters.orgs`


        - `View Organization Reports` for every Organization in `filters.orgs`
      operationId: Gettestcounts
      parameters:
        - name: from
          in: query
          description: The date you wish to count tests from, in the format `YYYY-MM-DD`
          required: true
          style: form
          explode: true
          schema:
            type: string
            example: 2017-07-01
        - name: to
          in: query
          description: The date you wish to count tests until, in the format `YYYY-MM-DD`
          required: true
          style: form
          explode: true
          schema:
            type: string
            example: 2017-07-03
        - name: groupBy
          in: query
          description: The field to group results by
          style: form
          explode: true
          schema:
            allOf:
              - $ref: '#/components/schemas/groupBy4'
              - description: The field to group results by
                example: isPrivate
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/TestsFilters'
                - example:
                    filters:
                      orgs: []
                      isPrivate: false
                      issuesPrevented: false
                      projects: []
            example:
              filters:
                orgs: []
                isPrivate: false
                issuesPrevented: false
                projects: []
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/TestCounts'
                  - example:
                      results:
                        - count: 0
                          isPrivate:
                            'true': 0
                            'false': 0
              example:
                results:
                  - count: 0
                    isPrivate:
                      'true': 0
                      'false': 0
        '400':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/ErrorResponse'
                  - example:
                      code: 400
                      ok: false
                      error:
                        name: ValidationError
                        innerErrors:
                          - invalid type filters.isPrivate is not a Boolean
              example:
                code: 400
                ok: false
                error:
                  name: ValidationError
                  innerErrors:
                    - invalid type filters.isPrivate is not a Boolean
      deprecated: false
  /org/{orgId}/webhooks:
    post:
      tags:
        - Webhooks
      summary: Create a webhook
      description: >-
        Snyk sends a `ping` event to the newly configured webhook so you can check you're able to receive the transports.### Required permissions


        - `View Organization`


        - `View Outbound Webhooks`


        - `Create Outbound Webhooks`
      operationId: Createawebhook
      security:
        - APIToken: []
      parameters:
        - name: orgId
          in: path
          description: The organization ID to list projects for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
      requestBody:
        description: ''
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/request'
                - example:
                    url: https://my.app.com/webhook-handler/snyk123
                    secret: a8be22bb7bed43a3ac24de3580093560
            example:
              url: https://my.app.com/webhook-handler/snyk123
              secret: a8be22bb7bed43a3ac24de3580093560
        required: true
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Createawebhookresponse'
                  - example:
                      id: d3cf26b3-2d77-497b-bce2-23b33cc15362
                      url: https://my.app.com/webhook-handler/snyk123
      deprecated: false
    get:
      tags:
        - Webhooks
      summary: List webhooks
      description: >-
        Snyk sends a `ping` event to the newly configured webhook so you can check you're able to receive the transports

        #### Required permissions


        - `View Organization`


        - `View Outbound Webhooks`
      operationId: Listwebhooks
      security:
        - APIToken: []
      parameters:
        - name: orgId
          in: path
          description: The organization ID to list projects for. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Listwebhooksresponse'
                  - example:
                      results:
                        - id: d3cf26b3-2d77-497b-bce2-23b33cc15362
                          url: https://my.app.com/webhook-handler/snyk123
                      total: 1
              example:
                results:
                  - id: d3cf26b3-2d77-497b-bce2-23b33cc15362
                    url: https://my.app.com/webhook-handler/snyk123
                total: 1
      deprecated: false
  /org/{orgId}/webhooks/{webhookId}:
    get:
      tags:
        - Webhooks
      summary: Retrieve a webhook
      description: >-
        #### Required permissions


        - `View Organization`


        - `View Outbound Webhooks`
      operationId: Retrieveawebhook
      security:
        - APIToken: []
      parameters:
        - name: orgId
          in: path
          description: The organization ID the project belongs to. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: webhookId
          in: path
          description: The webhook ID.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
        
      responses:
        '200':
          description: ''
          headers: {}
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Retrieveawebhookresponse'
                  - example:
                      id: d3cf26b3-2d77-497b-bce2-23b33cc15362
                      url: https://my.app.com/webhook-handler/snyk123
      deprecated: false
    delete:
      tags:
        - Webhooks
      summary: Delete a webhook
      description: >-
        #### Required permissions


        - `View Organization`


        - `View Outbound Webhooks`


        - `Remove Outbound Webhooks`
      operationId: Deleteawebhook
      security:
        - APIToken: []
      parameters:
        - name: orgId
          in: path
          description: The organization ID the project belongs to. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: webhookId
          in: path
          description: The webhook ID.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
        
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
  /org/{orgId}/webhooks/{webhookId}/ping:
    post:
      tags:
        - Webhooks
      summary: Ping a webhook
      description: >-
        #### Required permissions


        - `View Organization`


        - `View Outbound Webhooks`
      operationId: Pingawebhook
      security:
        - APIToken: []
      parameters:
        - name: orgId
          in: path
          description: The organization ID the project belongs to. The `API_KEY` must have access to this organization.
          required: true
          style: simple
          schema:
            type: string
            example: 4a18d42f-0706-4ad0-b127-24078731fbed
        - name: webhookId
          in: path
          description: The webhook ID.
          required: true
          style: simple
          schema:
            type: string
            example: 463c1ee5-31bc-428c-b451-b79a3270db08
        
      responses:
        '200':
          description: ''
          headers: {}
          content: {}
      deprecated: false
components:
  securitySchemes:
    APIToken:
      description: API key value must be prefixed with "Token ".
      in: header
      name: 'Authorization'
      type: apiKey
  schemas:
    Groupsettings:
      title: Groupsettings
      type: object
      properties:
        requestAccess:
          allOf:
            - $ref: '#/components/schemas/requestAccess'
            - description: Can only be updated if `API_KEY` has edit access to request access settings.
        sessionLength:
          type: number
          description: The new session length for the group in minutes. This must be an integer between 1 and 43200 (30 days). Setting this value to null will result in this group inheriting from the global default of 30 days.
    Tagbody:
      title: Tagbody
      type: object
      properties:
        key:
          type: string
          description: Valid tag key.
        value:
          type: string
          description: Valid tag value.
    Deletetagbody:
      title: Deletetagbody
      type: object
      properties:
        key:
          type: string
          description: Valid tag key.
        value:
          type: string
          description: Valid tag value.
        force:
          type: boolean
          description: force delete tag that has entities (default is `false`).
    Addmemberbody:
      title: Addmemberbody
      type: object
      properties:
        userId:
          type: string
          description: The id of the user.
        role:
          type: string
          description: The role of the user, "admin" or "collaborator".
    Createorganizationsbody:
      title: Createorganizationsbody
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: The name of the new organization
          example: new-org
        groupId:
          type: string
          description: The group ID. The `API_KEY` must have access to this group.
          example: 4a18d42f-0706-4ad0-b127-24078731fbed
        sourceOrgId:
          type: string
          description: >-
            The id of an organization to copy settings from.


            If provided, this organization must be associated with the same group.


            The items that will be copied are:

            Source control integrations (GitHub, GitLab, BitBucket)

            \+ Container registries integrations (ACR, Docker Hub, ECR, GCR)

            \+ Container orchestrators integrations (Kubernetes)

            \+ PaaS and Serverless Integrations (Heroku, AWS Lambda)

            \+ Notification integrations (Slack, Jira)

            \+ Policies

            \+ Ignore settings

            \+ Language settings

            \+ Infrastructure as Code settings

            \+ Snyk Code settings


            The following will not be copied across:

            Service accounts

            \+ Members

            \+ Projects

            \+ Notification preferences
          example: 6b4a3261-b68f-43a0-9218-1f082e77f879
    Integrationsettings:
      title: Integrationsettings
      type: object
      properties:
        autoDepUpgradeLimit:
          type: number
          description: A limit on how many automatic dependency upgrade PRs can be opened simultaneously
        autoDepUpgradeIgnoredDependencies:
          type: array
          items:
            type: string
          description: A list of strings defining what dependencies should be ignored
        autoDepUpgradeEnabled:
          type: boolean
          description: Defines if the functionality is enabled
        autoDepUpgradeMinAge:
          type: number
          description: The age (in days) that an automatic dependency check is valid for
        pullRequestFailOnAnyVulns:
          type: boolean
          description: If an opened PR should fail to be validated if any vulnerable dependencies have been detected
        pullRequestFailOnlyForHighSeverity:
          type: boolean
          description: If an opened PR only should fail its validation if any dependencies are marked as being of high severity
        pullRequestTestCodeEnabled:
          type: boolean
          description: If opened PRs should be tested with Snyk Code
        pullRequestTestCodeSeverity:
          type: string
          description: 'Snyk severity for this issue. One of: `low`, `medium`, `high`, or `null`.'
        pullRequestTestEnabled:
          type: boolean
          description: If opened PRs should be tested
        pullRequestAssignment:
          type: string
          description: assign Snyk pull requests
        autoRemediationPrs:
          allOf:
            - $ref: '#/components/schemas/autoRemediationPrs2'
            - description: Defines automatic remediation policies
        manualRemediationPrs:
          allOf:
            - $ref: '#/components/schemas/manualRemediationPrs'
            - description: Defines manual remediation policies
        dockerfileSCMEnabled:
          type: boolean
          description: If true, will automatically detect and scan Dockerfiles in your Git repositories, surface base image vulnerabilities and recommend possible fixes
    IntegrationType:
      title: IntegrationType
      enum:
        - acr
        - artifactory-cr
        - azure-repos
        - bitbucket-cloud
        - bitbucket-server
        - digitalocean-cr
        - docker-hub
        - ecr
        - gcr
        - github
        - github-cr
        - github-enterprise
        - gitlab
        - gitlab-cr
        - google-artifact-cr
        - harbor-cr
        - nexus-cr
        - quay-cr
      type: string
    BrokerSettings:
      title: BrokerSettings
      type: object
      properties:
        enabled:
          type: boolean
    Project:
      title: Project
      type: object
      properties:
        name:
          type: string
          example: snyk/goof
        id:
          type: string
          description: The project identifier
          example: af137b96-6966-46c1-826b-2e79ac49bbd9
        created:
          type: string
          description: The date that the project was created on
          example: 2018-10-29T09:50:54.014Z
        origin:
          type: string
          description: The origin the project was added from
          example: github
        type:
          type: string
          description: The package manager of the project
          example: maven
        readOnly:
          type: boolean
          description: Whether the project is read-only
          example: false
        testFrequency:
          type: string
          description: The frequency of automated Snyk re-test. Can be 'daily', 'weekly or 'never'
          example: daily
        totalDependencies:
          type: number
          description: Number of dependencies of the project
          example: 42
        issueCountsBySeverity:
          allOf:
            - $ref: '#/components/schemas/issueCountsBySeverity'
            - description: Number of known vulnerabilities in the project, not including ignored issues
        imageId:
          type: string
          description: For docker projects shows the ID of the image
          example: sha256:caf27325b298a6730837023a8a342699c8b7b388b8d878966b064a1320043019
        imageTag:
          type: string
          description: For docker projects shows the tag of the image
          example: latest
        imageBaseImage:
          type: string
          description: For docker projects shows the base image
          example: alpine:3
        imagePlatform:
          type: string
          description: For docker projects shows the platform of the image
          example: linux/arm64
        imageCluster:
          type: string
          description: For Kubernetes projects shows the origin cluster name
          example: Production
        hostname:
          type: string
          description: The hostname for a CLI project, null if not set
          nullable: true
        remoteRepoUrl:
          type: string
          description: The project remote repository url. Only set for projects imported via the Snyk CLI tool.
          example: https://github.com/snyk/goof.git
        lastTestedDate:
          type: string
          description: The date on which the most recent test was conducted for this project
          example: 2019-02-05T08:54:07.704Z
        owner:
          type: object
          description: >-
            The user who owns the project, null if not set


            {
                "id": "e713cf94-bb02-4ea0-89d9-613cce0caed2",
                "name": "example-user@snyk.io",
                "username": "exampleUser",
                "email": "example-user@snyk.io"
            }
          nullable: true
        browseUrl:
          type: string
          description: URL with project overview
          example: https://app.snyk.io/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/af137b96-6966-46c1-826b-2e79ac49bbd9
        importingUser:
          allOf:
            - $ref: '#/components/schemas/importingUser'
            - description: The user who imported the project
        isMonitored:
          type: boolean
          description: Describes if a project is currently monitored or it is de-activated
        branch:
          type: string
          description: The monitored branch (if available)
          nullable: true
        targetReference:
          type: string
          description: The identifier for which revision of the resource is scanned by Snyk. For example this may be a branch for SCM project, or a tag for a container image
          nullable: true
        tags:
          type: array
          items:
            type: string
          description: List of applied tags
        attributes:
          type: string
          description: Applied project attributes
        remediation:
          allOf:
            - $ref: '#/components/schemas/remediation'
            - description: Remediation data (if available)
    Projectwithoutremediation:
      title: Projectwithoutremediation
      type: object
      properties:
        name:
          type: string
          example: snyk/goof
        id:
          type: string
          description: The project identifier
          example: af137b96-6966-46c1-826b-2e79ac49bbd9
        created:
          type: string
          description: The date that the project was created on
          example: 2018-10-29T09:50:54.014Z
        origin:
          type: string
          description: The origin the project was added from
          example: github
        type:
          type: string
          description: The package manager of the project
          example: maven
        readOnly:
          type: boolean
          description: Whether the project is read-only
          example: false
        testFrequency:
          type: string
          description: The frequency of automated Snyk re-test. Can be 'daily', 'weekly or 'never'
          example: daily
        totalDependencies:
          type: number
          description: Number of dependencies of the project
          example: 42
        issueCountsBySeverity:
          allOf:
            - $ref: '#/components/schemas/issueCountsBySeverity'
            - description: Number of known vulnerabilities in the project, not including ignored issues
        imageId:
          type: string
          description: For docker projects shows the ID of the image
          example: sha256:caf27325b298a6730837023a8a342699c8b7b388b8d878966b064a1320043019
        imageTag:
          type: string
          description: For docker projects shows the tag of the image
          example: latest
        imageBaseImage:
          type: string
          description: For docker projects shows the base image
          example: alpine:3
        imagePlatform:
          type: string
          description: For docker projects shows the platform of the image
          example: linux/arm64
        imageCluster:
          type: string
          description: For Kubernetes projects shows the origin cluster name
          example: Production
        remoteRepoUrl:
          type: string
          description: The project remote repository url. Only set for projects imported via the Snyk CLI tool.
          example: https://github.com/snyk/goof.git
        lastTestedDate:
          type: string
          description: The date on which the most recent test was conducted for this project
          example: 2019-02-05T08:54:07.704Z
        owner:
          type: object
          description: >-
            The user who owns the project, null if not set


            {
                "id": "e713cf94-bb02-4ea0-89d9-613cce0caed2",
                "name": "example-user@snyk.io",
                "username": "exampleUser",
                "email": "example-user@snyk.io"
            }
          nullable: true
        browseUrl:
          type: string
          description: URL with project overview
          example: https://app.snyk.io/org/4a18d42f-0706-4ad0-b127-24078731fbed/project/af137b96-6966-46c1-826b-2e79ac49bbd9
        importingUser:
          allOf:
            - $ref: '#/components/schemas/importingUser'
            - description: The user who imported the project
        isMonitored:
          type: boolean
          description: Describes if a project is currently monitored or it is de-activated
        branch:
          type: string
          description: The monitored branch (if available)
          nullable: true
        targetReference:
          type: string
          description: The identifier for which revision of the resource is scanned by Snyk. For example this may be a branch for SCM project, or a tag for a container image
          nullable: true
        tags:
          type: array
          items:
            type: string
          description: List of applied tags
        attributes:
          type: string
          description: Applied project attributes
    Projectsfilters:
      title: Projectsfilters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/filters'
    Listallprojects:
      title: Listallprojects
      type: object
      properties:
        org:
          $ref: '#/components/schemas/org'
        projects:
          type: array
          items:
            $ref: '#/components/schemas/Projectwithoutremediation'
          description: A list of org's projects
    Aggregatedprojectissues:
      title: Aggregatedprojectissues
      type: object
      properties:
        issues:
          type: array
          items:
            $ref: '#/components/schemas/aggregatedProjectIssue'
          description: An array of identified issues
    Aggregatedprojectissuesfilters:
      title: Aggregatedprojectissuesfilters
      type: object
      properties:
        includeDescription:
          type: boolean
          description: If set to `true`, Include issue's description, if set to `false` (by default), it won't (Non-IaC projects only)
        includeIntroducedThrough:
          type: boolean
          description: If set to `true`, include the dockerfile instruction that the issue is introducedThrough. If set to false (default), it won’t. This only applies to Container projects with an associated Dockerfile (CLI or Container Registry source)
        filters:
          $ref: '#/components/schemas/aggregatedProjectIssuesfilter'
    Issuepaths:
      title: Issuepaths
      type: object
      properties:
        snapshotId:
          type: string
          description: The identifier of the snapshot for which the paths have been found
        paths:
          type: array
          items:
            type: array
            items: {}
          description: A list of the dependency paths that introduce the issue
        total:
          type: number
          description: The total number of results
        links:
          $ref: '#/components/schemas/issuePathsLinks'
    Projectsnapshots:
      title: Projectsnapshots
      type: object
      properties:
        snapshots:
          type: array
          items:
            $ref: '#/components/schemas/snapshots'
          description: A list of the project's snapshots, ordered according to date (latest first).
        total:
          type: number
          description: The total number of results
    Projectsnapshotsfilters:
      title: Projectsnapshotsfilters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/filters2'
    Projectdependencygraph:
      title: Projectdependencygraph
      required:
        - depGraph
      type: object
      properties:
        depGraph:
          $ref: '#/components/schemas/depGraph'
    Projectissuesfilters:
      title: Projectissuesfilters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/filters3'
    Allignores:
      title: Allignores
      required:
        - issueId
      type: object
      properties:
        issueId:
          type: array
          items:
            $ref: '#/components/schemas/Ignore'
          description: The issue ID that should be ignored.
    Ignore:
      title: Ignore
      required:
        - ignorePath
      type: object
      properties:
        ignorePath:
          $ref: '#/components/schemas/ignorePath'
    Ignorerule:
      title: Ignorerule
      required:
        - reasonType
        - disregardIfFixable
      type: object
      properties:
        ignorePath:
          type: string
          description: The path to ignore (default is `*` which represents all paths).
        reason:
          type: string
          description: The reason that the issue was ignored.
        reasonType:
          allOf:
            - $ref: '#/components/schemas/reasonType'
            - description: The classification of the ignore.
        disregardIfFixable:
          type: boolean
          description: Only ignore the issue if no upgrade or patch is available.
        expires:
          type: string
          description: The timestamp that the issue will no longer be ignored.
    Alljiraissues:
      title: Alljiraissues
      required:
        - issueId
      type: object
      properties:
        issueId:
          type: array
          items:
            $ref: '#/components/schemas/Jiraissue'
          description: The issue ID and relating jira issue.
    Jiraissue:
      title: Jiraissue
      type: object
      properties:
        jiraIssue:
          $ref: '#/components/schemas/jiraIssue1'
    Jiraissuerequest:
      title: Jiraissuerequest
      type: object
      properties:
        fields:
          $ref: '#/components/schemas/fields'
    Projectsettings:
      title: Projectsettings
      type: object
      properties:
        autoDepUpgradeEnabled:
          type: boolean
          description: If set to `true`, Snyk will raise dependency upgrade PRs automatically.
        autoDepUpgradeIgnoredDependencies:
          type: array
          items:
            type: string
          description: An array of comma-separated strings with names of dependencies you wish Snyk to ignore to upgrade.
        autoDepUpgradeMinAge:
          type: number
          description: The age (in days) that an automatic dependency check is valid for
        autoDepUpgradeLimit:
          type: number
          description: The limit on auto dependency upgrade PRs.
        pullRequestFailOnAnyVulns:
          type: boolean
          description: If set to `true`, fail Snyk Test if the repo has any vulnerabilities. Otherwise, fail only when the PR is adding a vulnerable dependency.
        pullRequestFailOnlyForHighSeverity:
          type: boolean
          description: If set to `true`, fail Snyk Test only for high and critical severity vulnerabilities
        pullRequestTestEnabled:
          type: boolean
          description: If set to `true`, Snyk Test checks PRs for vulnerabilities.:cq
        pullRequestAssignment:
          type: string
          description: assign Snyk pull requests
        autoRemediationPrs:
          type: string
          description: Defines automatic remediation policies
    Projectmove:
      title: Projectmove
      type: object
      properties:
        targetOrgId:
          type: string
          description: The ID of the organization that the project should be moved to. The API_KEY must have group admin permissions. If the project is moved to a new group, a personal level API key is needed.
    Dependencies:
      title: Dependencies
      required:
        - results
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/results'
          description: A list of issues
        total:
          type: number
          description: The number of results returned
    Dependenciesfilters:
      title: Dependenciesfilters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/filters4'
    Licenses:
      title: Licenses
      required:
        - results
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/results1'
          description: A list of licenses
        total:
          type: number
          description: The number of results returned
    Licensesfilters:
      title: Licensesfilters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/filters5'
    Vulnerability:
      title: Vulnerability
      type: object
      properties:
        title:
          type: string
          description: The title of the vulnerability
        credit:
          type: object
          description: The reporter of the vulnerability
        description:
          type: string
          description: The description of the vulnerability
        semver:
          $ref: '#/components/schemas/SemverObject'
        CVSSv3:
          type: string
          description: Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability, and produce a numerical score reflecting its severity, as well as a textual representation of that score.
        severity:
          type: string
          description: 'Snyk severity for this issue. One of: `critical`, `medium`, `high`, `medium` or `low`.'
        exploitMaturity:
          type: string
          description: 'Snyk exploit maturity for this issue. One of: `mature`, `proof-of-concept`, `no-known-exploit` or `no-data`.'
        identifiers:
          type: object
          description: Additional identifiers for this issue (CVE, CWE, etc).
        patches:
          type: array
          items:
            $ref: '#/components/schemas/Patch'
          description: Patches to fix this issue, by Snyk.
        packageName:
          type: string
          description: The name of the vulnerable package.
        creationTime:
          type: string
        publicationTime:
          type: string
        modificationTime:
          type: string
        disclosureTime:
          type: string
        language:
          type: string
          description: The programming language for this package.
        packageManager `npm`:
          type: string
        functions:
          type: array
          items:
            $ref: '#/components/schemas/Function'
          description: List of vulnerable functions inside the vulnerable packages.
        cvssScore:
          type: number
          description: CVSS Score.
        alternativeIds:
          type: object
        from:
          type: object
          description: Paths from which the vulnerable package is required in the code base.
        upgradePath:
          type: object
        isUpgradable:
          type: boolean
          description: Will upgrading a top-level dependency fix the vulnerability?
        isPinnable:
          type: boolean
          description: Will pinning this package to a newer version fix the vulnerability?
        isPatchable:
          type: boolean
          description: Is a patch by Snyk available to fix this vulnerability?
    Mavenrequestpayload:
      title: Mavenrequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files'
            - description: 'The manifest files:'
    govendorrequestpayload:
      title: govendorrequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files1'
            - description: 'The manifest files:'
    golangdeprequestpayload:
      title: golangdeprequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files2'
            - description: 'The manifest files:'
    npmrequestpayload:
      title: npmrequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files3'
            - description: 'The manifest files:'
    yarnrequestpayload:
      title: yarnrequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files4'
            - description: 'The manifest files:'
    rubygemsrequestpayload:
      title: rubygemsrequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files5'
            - description: 'The manifest files:'
    Gradlerequestpayload:
      title: Gradlerequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files6'
            - description: 'The manifest files:'
    sbtrequestpayload:
      title: sbtrequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files7'
            - description: 'The manifest files:'
    piprequestpayload:
      title: piprequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files8'
            - description: 'The manifest files:'
    composerrequestpayload:
      title: composerrequestpayload
      required:
        - files
      type: object
      properties:
        encoding:
          allOf:
            - $ref: '#/components/schemas/encoding'
            - description: the encoding for the manifest files sent.
        files:
          allOf:
            - $ref: '#/components/schemas/files9'
            - description: 'The manifest files:'
    graphrequestpayload:
      title: graphrequestpayload
      required:
        - depGraph
      type: object
      properties:
        depGraph:
          $ref: '#/components/schemas/DepGraphData'
    SemverObject:
      title: SemverObject
      type: object
      properties:
        vulnerable:
          type: string
          description: The (semver) range of versions vulnerable to this issue.
        unaffected:
          type: string
          description: The (semver) range of versions NOT vulnerable to this issue. *Deprecated* and should not be used.
    Patch:
      title: Patch
      type: object
      properties:
        urls:
          type: array
          items:
            type: string
          description: Links to patch files to fix an issue.
        version:
          type: string
          description: Versions this patch is applicable to, in semver format.
        modificationTime:
          type: string
        comments:
          type: array
          items:
            type: string
          description: ''
        id:
          type: string
    Function:
      title: Function
      type: object
      properties:
        functionId:
          $ref: '#/components/schemas/FunctionId'
        version:
          type: array
          items:
            type: string
          description: Versions this function relates to.
    FunctionId:
      title: FunctionId
      type: object
      properties:
        functionName:
          type: string
          description: Function name.
        className?:
          type: string
          description: Class name (Java only).
        filePath?:
          type: string
          description: Path to file (Javascript only).
    MavenFile:
      title: MavenFile
      required:
        - contents
      type: object
      properties:
        contents:
          type: string
          description: The contents of the file, encoded according to the `encoding` field.
          example: <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <modelVersion>4.0.0</modelVersion> <parent> <artifactId>io.snyk.example</artifactId> <groupId>parent</groupId> <version>1.0-SNAPSHOT</version> </parent> <artifactId>my-project</artifactId> <dependencies> <dependency> <groupId>axis</groupId> <artifactId>axis</artifactId> <version>1.4</version> </dependency> </dependencies> </project>\n
    MavenAdditionalFile:
      title: MavenAdditionalFile
      required:
        - contents
      type: object
      properties:
        contents:
          type: string
          description: The contents of the file, encoded according to the `encoding` field.
          example: <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> <modelVersion>4.0.0</modelVersion> <artifactId>io.snyk.example</artifactId> <groupId>parent</groupId> <version>1.0-SNAPSHOT</version> <dependencies> <dependency> <groupId>org.apache.zookeeper</groupId> <artifactId>zookeeper</artifactId> <version>3.5</version> </dependency> <dependency> <groupId>org.aspectj</groupId> <artifactId>aspectjweaver</artifactId> <version>1.8.2</version> </dependency> </dependencies> </project>\n
    GradleFile:
      title: GradleFile
      required:
        - contents
      type: object
      properties:
        contents:
          type: string
          description: The contents of the file, encoded according to the `encoding` field.
          example: dependencies { compile 'axis:axis:1.4' }
    SBTFile:
      title: SBTFile
      required:
        - contents
      type: object
      properties:
        contents:
          type: string
          description: The contents of the file, encoded according to the `encoding` field.
          example: '\nname := \"subsearch\"\n\nassemblyJarName in assembly := s\"subsearch-0.2.0.jar\"\n\nscalaVersion := \"2.11.8\"\n\nscalacOptions ++= Seq(\"-unchecked\", \"-deprecation\")\n\nresolvers += Resolver.sonatypeRepo(\"public\")\n\nlibraryDependencies += \"org.scalatest\" % \"scalatest_2.11\" % \"2.2.1\" % \"test\"\nlibraryDependencies += \"org.scalamock\" %% \"scalamock-scalatest-support\" % \"3.2.2\" % \"test\"\nlibraryDependencies += \"net.databinder.dispatch\" %% \"dispatch-core\" % \"0.11.2\"\nlibraryDependencies += \"org.slf4j\" % \"slf4j-simple\" % \"1.6.6\"\nlibraryDependencies += \"com.github.scopt\" %% \"scopt\" % \"3.4.0\"\nlibraryDependencies += \"pl.project13.scala\" %% \"rainbow\" % \"0.2\"\nlibraryDependencies += \"dnsjava\" % \"dnsjava\" % \"2.1.7\"\nlibraryDependencies += \"com.typesafe.akka\" %% \"akka-actor\" % \"2.4.1\"\nlibraryDependencies += \"org.scala-lang.modules\" % \"scala-jline\" % \"2.12.1\"\nlibraryDependencies += \"net.ruippeixotog\" %% \"scala-scraper\" % \"1.0.0\"'
    PackageLockJsonFile:
      title: PackageLockJsonFile
      type: object
      properties:
        contents:
          type: string
          description: The contents of the file, encoded according to the `encoding` field.
          example: eyAibmFtZSI6ICJzaGFsbG93LWdvb2YiLCAidmVyc2lvbiI6ICIwLjAuMSIsICJsb2NrZmlsZVZlcnNpb24iOiAxLCAicmVxdWlyZXMiOiB0cnVlLCAiZGVwZW5kZW5jaWVzIjogeyAibm9kZS11dWlkIjogeyAidmVyc2lvbiI6ICIxLjQuMCIsICJyZXNvbHZlZCI6ICJodHRwczovL3JlZ2lzdHJ5Lm5wbWpzLm9yZy9ub2RlLXV1aWQvLS9ub2RlLXV1aWQtMS40LjAudGd6IiwgImludGVncml0eSI6ICJzaGExLUIvbXlNM1Z5LzJKMXgzWGgxSVVUODZSZGVtVT0iIH0sICJxcyI6IHsgInZlcnNpb24iOiAiMC4wLjYiLCAicmVzb2x2ZWQiOiAiaHR0cHM6Ly9yZWdpc3RyeS5ucG1qcy5vcmcvcXMvLS9xcy0wLjAuNi50Z3oiLCAiaW50ZWdyaXR5IjogInNoYTEtU0JaWnQrVy9hbDZvbUFFTjVhN1RYclJwNFNRPSIgfSB9IH0K
    YarnLockFile:
      title: YarnLockFile
      type: object
      properties:
        contents:
          type: string
          example: '# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.\r\n# yarn lockfile v1\r\n\r\n\r\nnode-uuid@1.4.0:\r\n  version \"1.4.0\"\r\n  resolved \"https:\/\/registry.yarnpkg.com\/node-uuid\/-\/node-uuid-1.4.0.tgz#07f9b2337572ff6275c775e1d48513f3a45d7a65\"\r\n  integrity sha1-B\/myM3Vy\/2J1x3Xh1IUT86RdemU=\r\n\r\nqs@0.0.6:\r\n  version \"0.0.6\"\r\n  resolved \"https:\/\/registry.yarnpkg.com\/qs\/-\/qs-0.0.6.tgz#481659b7e5bf6a5ea898010de5aed35eb469e124\"\r\n  integrity sha1-SBZZt+W\/al6omAEN5a7TXrRp4SQ=\r\n'
    GoPkgLock:
      title: GoPkgLock
      type: object
      properties:
        contents:
          type: string
          example: "\"# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.\\r\\n\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:e2a1ff1174d564ed4b75a62757f4a9081ed3b8c99ed17e47eb252b048b4ff018\\\"\\r\\n  name = \\\"github.com/asaskevich/EventBus\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"d46933a94f05c6657d7b923fcf5ac563ee37ec79\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:b95c3763b72359370262246870366418c1d17446195e3c73921135c2537b9655\\\"\\r\\n  name = \\\"github.com/cloudevents/sdk-go\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"v02\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"3a3d34a7231e937edfa20964dc25c29081c3ebea\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:abeb38ade3f32a92943e5be54f55ed6d6e3b6602761d74b4aab4c9dd45c18abd\\\"\\r\\n  name = \\\"github.com/fsnotify/fsnotify\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c2828203cd70a50dcccfb2761f8b1f8ceef9a8e9\\\"\\r\\n  version = \\\"v1.4.7\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:36fe9527deed01d2a317617e59304eb2c4ce9f8a24115bcc5c2e37b3aee5bae4\\\"\\r\\n  name = \\\"github.com/gin-contrib/sse\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"22d885f9ecc78bf4ee5d72b937e4bbcdc58e8cae\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:d5083934eb25e45d17f72ffa86cae3814f4a9d6c073c4f16b64147169b245606\\\"\\r\\n  name = \\\"github.com/gin-gonic/gin\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"binding\\\",\\r\\n    \\\"json\\\",\\r\\n    \\\"render\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"b869fe1415e4b9eb52f247441830d502aece2d4d\\\"\\r\\n  version = \\\"v1.3.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:4c0989ca0bcd10799064318923b9bc2db6b4d6338dd75f3f2d86c3511aaaf5cf\\\"\\r\\n  name = \\\"github.com/golang/protobuf\\\"\\r\\n  packages = [\\r\\n    \\\"proto\\\",\\r\\n    \\\"ptypes\\\",\\r\\n    \\\"ptypes/any\\\",\\r\\n    \\\"ptypes/duration\\\",\\r\\n    \\\"ptypes/timestamp\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"aa810b61a9c79d51363740d207bb46cf8e620ed5\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:4e0e5d786c35c402574cda1906195d9fbd76a35d2c921eb10199741faf4f0256\\\"\\r\\n  name = \\\"github.com/goph/emperror\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"b1b4a9b847ebc56299eb729faa942b89e9d8a562\\\"\\r\\n  version = \\\"v0.14.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:dd95856542089c3e0487299d6ac92f5f2941e97625b5a5754a483c7730e8dc89\\\"\\r\\n  name = \\\"github.com/goph/logur\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"111a952ccfacab0a90b9e4496da21d9f15187769\\\"\\r\\n  version = \\\"v0.5.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c0d19ab64b32ce9fe5cf4ddceba78d5bc9807f0016db6b1183599da3dcc24d10\\\"\\r\\n  name = \\\"github.com/hashicorp/hcl\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"hcl/ast\\\",\\r\\n    \\\"hcl/parser\\\",\\r\\n    \\\"hcl/printer\\\",\\r\\n    \\\"hcl/scanner\\\",\\r\\n    \\\"hcl/strconv\\\",\\r\\n    \\\"hcl/token\\\",\\r\\n    \\\"json/parser\\\",\\r\\n    \\\"json/scanner\\\",\\r\\n    \\\"json/token\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"8cb6e5b959231cc1119e43259c4a608f9c51a241\\\"\\r\\n  version = \\\"v1.0.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:be97e109f627d3ba8edfef50c9c74f0d0c17cbe3a2e924a8985e4804a894f282\\\"\\r\\n  name = \\\"github.com/json-iterator/go\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"36b14963da70d11297d313183d7e6388c8510e1e\\\"\\r\\n  version = \\\"1.0.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:0a69a1c0db3591fcefb47f115b224592c8dfa4368b7ba9fae509d5e16cdc95c8\\\"\\r\\n  name = \\\"github.com/konsorten/go-windows-terminal-sequences\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"5c8c8bd35d3832f5d134ae1e1e375b69a4d25242\\\"\\r\\n  version = \\\"v1.0.1\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c568d7727aa262c32bdf8a3f7db83614f7af0ed661474b24588de635c20024c7\\\"\\r\\n  name = \\\"github.com/magiconair/properties\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c2353362d570a7bfa228149c62842019201cfb71\\\"\\r\\n  version = \\\"v1.8.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:fa610f9fe6a93f4a75e64c83673dfff9bf1a34bbb21e6102021b6bc7850834a3\\\"\\r\\n  name = \\\"github.com/mattn/go-isatty\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"57fdcb988a5c543893cc61bce354a6e24ab70022\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:53bc4cd4914cd7cd52139990d5170d6dc99067ae31c56530621b18b35fc30318\\\"\\r\\n  name = \\\"github.com/mitchellh/mapstructure\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"3536a929edddb9a5b34bd6861dc4a9647cb459fe\\\"\\r\\n  version = \\\"v1.1.2\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:808cdddf087fb64baeae67b8dfaee2069034d9704923a3cb8bd96a995421a625\\\"\\r\\n  name = \\\"github.com/patrickmn/go-cache\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"a3647f8e31d79543b2d0f0ae2fe5c379d72cedc0\\\"\\r\\n  version = \\\"v2.1.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:95741de3af260a92cc5c7f3f3061e85273f5a81b5db20d4bd68da74bd521675e\\\"\\r\\n  name = \\\"github.com/pelletier/go-toml\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c01d1270ff3e442a8a57cddc1c92dc1138598194\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:40e195917a951a8bf867cd05de2a46aaf1806c50cf92eebf4c16f78cd196f747\\\"\\r\\n  name = \\\"github.com/pkg/errors\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"645ef00459ed84a119197bfb8d8205042c6df63d\\\"\\r\\n  version = \\\"v0.8.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:274f67cb6fed9588ea2521ecdac05a6d62a8c51c074c1fccc6a49a40ba80e925\\\"\\r\\n  name = \\\"github.com/satori/go.uuid\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"f58768cc1a7a7e77a3bd49e98cdd21419399b6a3\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:69b1cc331fca23d702bd72f860c6a647afd0aa9fcbc1d0659b1365e26546dd70\\\"\\r\\n  name = \\\"github.com/sirupsen/logrus\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"bcd833dfe83d3cebad139e4a29ed79cb2318bf95\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:d707dbc1330c0ed177d4642d6ae102d5e2c847ebd0eb84562d0dc4f024531cfc\\\"\\r\\n  name = \\\"github.com/spf13/afero\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"mem\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"a5d6946387efe7d64d09dcba68cdd523dc1273a3\\\"\\r\\n  version = \\\"v1.2.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:08d65904057412fc0270fc4812a1c90c594186819243160dc779a402d4b6d0bc\\\"\\r\\n  name = \\\"github.com/spf13/cast\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"8c9545af88b134710ab1cd196795e7f2388358d7\\\"\\r\\n  version = \\\"v1.3.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:68ea4e23713989dc20b1bded5d9da2c5f9be14ff9885beef481848edd18c26cb\\\"\\r\\n  name = \\\"github.com/spf13/jwalterweatherman\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"4a4406e478ca629068e7768fc33f3f044173c0a6\\\"\\r\\n  version = \\\"v1.0.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c1b1102241e7f645bc8e0c22ae352e8f0dc6484b6cb4d132fa9f24174e0119e2\\\"\\r\\n  name = \\\"github.com/spf13/pflag\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"298182f68c66c05229eb03ac171abe6e309ee79a\\\"\\r\\n  version = \\\"v1.0.3\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:de37e343c64582d7026bf8ab6ac5b22a72eac54f3a57020db31524affed9f423\\\"\\r\\n  name = \\\"github.com/spf13/viper\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"6d33b5a963d922d182c91e8a1c88d81fd150cfd4\\\"\\r\\n  version = \\\"v1.3.1\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:c268acaa4a4d94a467980e5e91452eb61c460145765293dc0aed48e5e9919cc6\\\"\\r\\n  name = \\\"github.com/ugorji/go\\\"\\r\\n  packages = [\\\"codec\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"c88ee250d0221a57af388746f5cf03768c21d6e2\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:38f553aff0273ad6f367cb0a0f8b6eecbaef8dc6cb8b50e57b6a81c1d5b1e332\\\"\\r\\n  name = \\\"golang.org/x/crypto\\\"\\r\\n  packages = [\\\"ssh/terminal\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"505ab145d0a99da450461ae2c1a9f6cd10d1f447\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:89a0cb976397aa9157a45bb2b896d0bcd07ee095ac975e0f03c53250c402265e\\\"\\r\\n  name = \\\"golang.org/x/net\\\"\\r\\n  packages = [\\r\\n    \\\"context\\\",\\r\\n    \\\"http/httpguts\\\",\\r\\n    \\\"http2\\\",\\r\\n    \\\"http2/hpack\\\",\\r\\n    \\\"idna\\\",\\r\\n    \\\"internal/timeseries\\\",\\r\\n    \\\"trace\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"e147a9138326bc0e9d4e179541ffd8af41cff8a9\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:ba8cbf57cfd92d5f8592b4aca1a35d92c162363d32aeabd5b12555f8896635e7\\\"\\r\\n  name = \\\"golang.org/x/sys\\\"\\r\\n  packages = [\\r\\n    \\\"unix\\\",\\r\\n    \\\"windows\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"4d1cda033e0619309c606fc686de3adcf599539e\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:a2ab62866c75542dd18d2b069fec854577a20211d7c0ea6ae746072a1dccdd18\\\"\\r\\n  name = \\\"golang.org/x/text\\\"\\r\\n  packages = [\\r\\n    \\\"collate\\\",\\r\\n    \\\"collate/build\\\",\\r\\n    \\\"internal/colltab\\\",\\r\\n    \\\"internal/gen\\\",\\r\\n    \\\"internal/tag\\\",\\r\\n    \\\"internal/triegen\\\",\\r\\n    \\\"internal/ucd\\\",\\r\\n    \\\"language\\\",\\r\\n    \\\"secure/bidirule\\\",\\r\\n    \\\"transform\\\",\\r\\n    \\\"unicode/bidi\\\",\\r\\n    \\\"unicode/cldr\\\",\\r\\n    \\\"unicode/norm\\\",\\r\\n    \\\"unicode/rangetable\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"f21a4dfb5e38f5895301dc265a8def02365cc3d0\\\"\\r\\n  version = \\\"v0.3.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  branch = \\\"master\\\"\\r\\n  digest = \\\"1:077c1c599507b3b3e9156d17d36e1e61928ee9b53a5b420f10f28ebd4a0b275c\\\"\\r\\n  name = \\\"google.golang.org/genproto\\\"\\r\\n  packages = [\\\"googleapis/rpc/status\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"bd91e49a0898e27abb88c339b432fa53d7497ac0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:9edd250a3c46675d0679d87540b30c9ed253b19bd1fd1af08f4f5fb3c79fc487\\\"\\r\\n  name = \\\"google.golang.org/grpc\\\"\\r\\n  packages = [\\r\\n    \\\".\\\",\\r\\n    \\\"balancer\\\",\\r\\n    \\\"balancer/base\\\",\\r\\n    \\\"balancer/roundrobin\\\",\\r\\n    \\\"binarylog/grpc_binarylog_v1\\\",\\r\\n    \\\"codes\\\",\\r\\n    \\\"connectivity\\\",\\r\\n    \\\"credentials\\\",\\r\\n    \\\"credentials/internal\\\",\\r\\n    \\\"encoding\\\",\\r\\n    \\\"encoding/proto\\\",\\r\\n    \\\"grpclog\\\",\\r\\n    \\\"internal\\\",\\r\\n    \\\"internal/backoff\\\",\\r\\n    \\\"internal/binarylog\\\",\\r\\n    \\\"internal/channelz\\\",\\r\\n    \\\"internal/envconfig\\\",\\r\\n    \\\"internal/grpcrand\\\",\\r\\n    \\\"internal/grpcsync\\\",\\r\\n    \\\"internal/syscall\\\",\\r\\n    \\\"internal/transport\\\",\\r\\n    \\\"keepalive\\\",\\r\\n    \\\"metadata\\\",\\r\\n    \\\"naming\\\",\\r\\n    \\\"peer\\\",\\r\\n    \\\"resolver\\\",\\r\\n    \\\"resolver/dns\\\",\\r\\n    \\\"resolver/passthrough\\\",\\r\\n    \\\"stats\\\",\\r\\n    \\\"status\\\",\\r\\n    \\\"tap\\\",\\r\\n  ]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"df014850f6dee74ba2fc94874043a9f3f75fbfd8\\\"\\r\\n  version = \\\"v1.17.0\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:cbc72c4c4886a918d6ab4b95e347ffe259846260f99ebdd8a198c2331cf2b2e9\\\"\\r\\n  name = \\\"gopkg.in/go-playground/validator.v8\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"5f1438d3fca68893a817e4a66806cea46a9e4ebf\\\"\\r\\n  version = \\\"v8.18.2\\\"\\r\\n\\r\\n[[projects]]\\r\\n  digest = \\\"1:4d2e5a73dc1500038e504a8d78b986630e3626dc027bc030ba5c75da257cdb96\\\"\\r\\n  name = \\\"gopkg.in/yaml.v2\\\"\\r\\n  packages = [\\\".\\\"]\\r\\n  pruneopts = \\\"UT\\\"\\r\\n  revision = \\\"51d6538a90f86fe93ac480b35f37b2be17fef232\\\"\\r\\n  version = \\\"v2.2.2\\\"\\r\\n\\r\\n[solve-meta]\\r\\n  analyzer-name = \\\"dep\\\"\\r\\n  analyzer-version = 1\\r\\n  input-imports = [\\r\\n    \\\"github.com/asaskevich/EventBus\\\",\\r\\n    \\\"github.com/cloudevents/sdk-go/v02\\\",\\r\\n    \\\"github.com/gin-gonic/gin\\\",\\r\\n    \\\"github.com/golang/protobuf/proto\\\",\\r\\n    \\\"github.com/goph/emperror\\\",\\r\\n    \\\"github.com/goph/logur\\\",\\r\\n    \\\"github.com/karlseguin/ccache\\\",\\r\\n    \\\"github.com/patrickmn/go-cache\\\",\\r\\n    \\\"github.com/pkg/errors\\\",\\r\\n    \\\"github.com/satori/go.uuid\\\",\\r\\n    \\\"github.com/sirupsen/logrus\\\",\\r\\n    \\\"github.com/spf13/cast\\\",\\r\\n    \\\"github.com/spf13/pflag\\\",\\r\\n    \\\"github.com/spf13/viper\\\",\\r\\n    \\\"golang.org/x/net/context\\\",\\r\\n    \\\"google.golang.org/grpc\\\",\\r\\n    \\\"gopkg.in/go-playground/validator.v8\\\",\\r\\n    \\\"gopkg.in/yaml.v2\\\",\\r\\n  ]\\r\\n  solver-name = \\\"gps-cdcl\\\"\\r\\n  solver-version = 1\""
    ComposerLock:
      title: ComposerLock
      type: object
      properties:
        contents:
          type: string
          example: '{"_readme":["This file locks the dependencies of your project to a known state","Read more about it at https://getcomposer.org/doc/01-basic-usage.md#composer-lock-the-lock-file","This file is @generated automatically"],"content-hash":"3a3771e545494c4c098e639bd68602ba","packages":[{"name":"aws/aws-sdk-php","version":"3.0.0","source":{"type":"git","url":"https://github.com/aws/aws-sdk-php.git","reference":"4018c8f14a9e53003bb0417fa859c6a7ad57b53b"},"dist":{"type":"zip","url":"https://api.github.com/repos/aws/aws-sdk-php/zipball/4018c8f14a9e53003bb0417fa859c6a7ad57b53b","reference":"4018c8f14a9e53003bb0417fa859c6a7ad57b53b","shasum":""},"require":{"guzzlehttp/guzzle":"^5.3 || ^6.0.1","guzzlehttp/promises":"^1.0.0","guzzlehttp/psr7":"^1.0.0","mtdowling/jmespath.php":"^2.2","php":">=5.5"},"require-dev":{"ext-dom":"*","ext-json":"*","ext-openssl":"*","ext-pcre":"*","ext-simplexml":"*","ext-spl":"*","phpunit/phpunit":"^4.0"},"suggest":{"ext-curl":"To send requests using cURL","ext-openssl":"Allows working with CloudFront private distributions and verifying received SNS messages"},"type":"library","extra":{"branch-alias":{"dev-master":"3.0-dev"}},"autoload":{"psr-4":{"Aws\":"src/"},"files":["src/functions.php"]},"notification-url":"https://packagist.org/downloads/","license":["Apache-2.0"],"authors":[{"name":"Amazon Web Services","homepage":"http://aws.amazon.com"}],"description":"AWS SDK for PHP - Use Amazon Web Services in your PHP project","homepage":"http://aws.amazon.com/sdkforphp","keywords":["amazon","aws","cloud","dynamodb","ec2","glacier","s3","sdk"],"time":"2015-05-27T20:07:42+00:00"},{"name":"doctrine/annotations","version":"v1.5.0","source":{"type":"git","url":"https://github.com/doctrine/annotations.git","reference":"5beebb01b025c94e93686b7a0ed3edae81fe3e7f"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/annotations/zipball/5beebb01b025c94e93686b7a0ed3edae81fe3e7f","reference":"5beebb01b025c94e93686b7a0ed3edae81fe3e7f","shasum":""},"require":{"doctrine/lexer":"1.*","php":"^7.1"},"require-dev":{"doctrine/cache":"1.*","phpunit/phpunit":"^5.7"},"type":"library","extra":{"branch-alias":{"dev-master":"1.5.x-dev"}},"autoload":{"psr-4":{"Doctrine\Common\Annotations\":"lib/Doctrine/Common/Annotations"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Docblock Annotations Parser","homepage":"http://www.doctrine-project.org","keywords":["annotations","docblock","parser"],"time":"2017-07-22T10:58:02+00:00"},{"name":"doctrine/cache","version":"v1.7.1","source":{"type":"git","url":"https://github.com/doctrine/cache.git","reference":"b3217d58609e9c8e661cd41357a54d926c4a2a1a"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/cache/zipball/b3217d58609e9c8e661cd41357a54d926c4a2a1a","reference":"b3217d58609e9c8e661cd41357a54d926c4a2a1a","shasum":""},"require":{"php":"~7.1"},"conflict":{"doctrine/common":">2.2,<2.4"},"require-dev":{"alcaeus/mongo-php-adapter":"^1.1","mongodb/mongodb":"^1.1","phpunit/phpunit":"^5.7","predis/predis":"~1.0"},"suggest":{"alcaeus/mongo-php-adapter":"Required to use legacy MongoDB driver"},"type":"library","extra":{"branch-alias":{"dev-master":"1.7.x-dev"}},"autoload":{"psr-4":{"Doctrine\Common\Cache\":"lib/Doctrine/Common/Cache"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Caching library offering an object-oriented API for many cache backends","homepage":"http://www.doctrine-project.org","keywords":["cache","caching"],"time":"2017-08-25T07:02:50+00:00"},{"name":"doctrine/collections","version":"v1.5.0","source":{"type":"git","url":"https://github.com/doctrine/collections.git","reference":"a01ee38fcd999f34d9bfbcee59dbda5105449cbf"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/collections/zipball/a01ee38fcd999f34d9bfbcee59dbda5105449cbf","reference":"a01ee38fcd999f34d9bfbcee59dbda5105449cbf","shasum":""},"require":{"php":"^7.1"},"require-dev":{"doctrine/coding-standard":"~0.1@dev","phpunit/phpunit":"^5.7"},"type":"library","extra":{"branch-alias":{"dev-master":"1.3.x-dev"}},"autoload":{"psr-0":{"Doctrine\Common\Collections\":"lib/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Collections Abstraction library","homepage":"http://www.doctrine-project.org","keywords":["array","collections","iterator"],"time":"2017-07-22T10:37:32+00:00"},{"name":"doctrine/common","version":"v2.5.0","source":{"type":"git","url":"https://github.com/doctrine/common.git","reference":"cd8daf2501e10c63dced7b8b9b905844316ae9d3"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/common/zipball/cd8daf2501e10c63dced7b8b9b905844316ae9d3","reference":"cd8daf2501e10c63dced7b8b9b905844316ae9d3","shasum":""},"require":{"doctrine/annotations":"1.*","doctrine/cache":"1.*","doctrine/collections":"1.*","doctrine/inflector":"1.*","doctrine/lexer":"1.*","php":">=5.3.2"},"require-dev":{"phpunit/phpunit":"~3.7"},"type":"library","extra":{"branch-alias":{"dev-master":"2.6.x-dev"}},"autoload":{"psr-0":{"Doctrine\Common\":"lib/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Common Library for Doctrine projects","homepage":"http://www.doctrine-project.org","keywords":["annotations","collections","eventmanager","persistence","spl"],"time":"2015-04-02T19:55:44+00:00"},{"name":"doctrine/inflector","version":"v1.2.0","source":{"type":"git","url":"https://github.com/doctrine/inflector.git","reference":"e11d84c6e018beedd929cff5220969a3c6d1d462"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/inflector/zipball/e11d84c6e018beedd929cff5220969a3c6d1d462","reference":"e11d84c6e018beedd929cff5220969a3c6d1d462","shasum":""},"require":{"php":"^7.0"},"require-dev":{"phpunit/phpunit":"^6.2"},"type":"library","extra":{"branch-alias":{"dev-master":"1.2.x-dev"}},"autoload":{"psr-4":{"Doctrine\Common\Inflector\":"lib/Doctrine/Common/Inflector"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Benjamin Eberlei","email":"kontakt@beberlei.de"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Jonathan Wage","email":"jonwage@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Common String Manipulations with regard to casing and singular/plural rules.","homepage":"http://www.doctrine-project.org","keywords":["inflection","pluralize","singularize","string"],"time":"2017-07-22T12:18:28+00:00"},{"name":"doctrine/lexer","version":"v1.0.1","source":{"type":"git","url":"https://github.com/doctrine/lexer.git","reference":"83893c552fd2045dd78aef794c31e694c37c0b8c"},"dist":{"type":"zip","url":"https://api.github.com/repos/doctrine/lexer/zipball/83893c552fd2045dd78aef794c31e694c37c0b8c","reference":"83893c552fd2045dd78aef794c31e694c37c0b8c","shasum":""},"require":{"php":">=5.3.2"},"type":"library","extra":{"branch-alias":{"dev-master":"1.0.x-dev"}},"autoload":{"psr-0":{"Doctrine\Common\Lexer\":"lib/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Roman Borschel","email":"roman@code-factory.org"},{"name":"Guilherme Blanco","email":"guilhermeblanco@gmail.com"},{"name":"Johannes Schmitt","email":"schmittjoh@gmail.com"}],"description":"Base library for a lexer that can be used in Top-Down, Recursive Descent Parsers.","homepage":"http://www.doctrine-project.org","keywords":["lexer","parser"],"time":"2014-09-09T13:34:57+00:00"},{"name":"guzzlehttp/guzzle","version":"6.3.0","source":{"type":"git","url":"https://github.com/guzzle/guzzle.git","reference":"f4db5a78a5ea468d4831de7f0bf9d9415e348699"},"dist":{"type":"zip","url":"https://api.github.com/repos/guzzle/guzzle/zipball/f4db5a78a5ea468d4831de7f0bf9d9415e348699","reference":"f4db5a78a5ea468d4831de7f0bf9d9415e348699","shasum":""},"require":{"guzzlehttp/promises":"^1.0","guzzlehttp/psr7":"^1.4","php":">=5.5"},"require-dev":{"ext-curl":"*","phpunit/phpunit":"^4.0 || ^5.0","psr/log":"^1.0"},"suggest":{"psr/log":"Required for using the Log middleware"},"type":"library","extra":{"branch-alias":{"dev-master":"6.2-dev"}},"autoload":{"files":["src/functions_include.php"],"psr-4":{"GuzzleHttp\":"src/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"}],"description":"Guzzle is a PHP HTTP client library","homepage":"http://guzzlephp.org/","keywords":["client","curl","framework","http","http client","rest","web service"],"time":"2017-06-22T18:50:49+00:00"},{"name":"guzzlehttp/promises","version":"v1.3.1","source":{"type":"git","url":"https://github.com/guzzle/promises.git","reference":"a59da6cf61d80060647ff4d3eb2c03a2bc694646"},"dist":{"type":"zip","url":"https://api.github.com/repos/guzzle/promises/zipball/a59da6cf61d80060647ff4d3eb2c03a2bc694646","reference":"a59da6cf61d80060647ff4d3eb2c03a2bc694646","shasum":""},"require":{"php":">=5.5.0"},"require-dev":{"phpunit/phpunit":"^4.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.4-dev"}},"autoload":{"psr-4":{"GuzzleHttp\Promise\":"src/"},"files":["src/functions_include.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"}],"description":"Guzzle promises library","keywords":["promise"],"time":"2016-12-20T10:07:11+00:00"},{"name":"guzzlehttp/psr7","version":"1.4.2","source":{"type":"git","url":"https://github.com/guzzle/psr7.git","reference":"f5b8a8512e2b58b0071a7280e39f14f72e05d87c"},"dist":{"type":"zip","url":"https://api.github.com/repos/guzzle/psr7/zipball/f5b8a8512e2b58b0071a7280e39f14f72e05d87c","reference":"f5b8a8512e2b58b0071a7280e39f14f72e05d87c","shasum":""},"require":{"php":">=5.4.0","psr/http-message":"~1.0"},"provide":{"psr/http-message-implementation":"1.0"},"require-dev":{"phpunit/phpunit":"~4.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.4-dev"}},"autoload":{"psr-4":{"GuzzleHttp\Psr7\":"src/"},"files":["src/functions_include.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"},{"name":"Tobias Schultze","homepage":"https://github.com/Tobion"}],"description":"PSR-7 message implementation that also provides common utility methods","keywords":["http","message","request","response","stream","uri","url"],"time":"2017-03-20T17:10:46+00:00"},{"name":"mtdowling/jmespath.php","version":"2.4.0","source":{"type":"git","url":"https://github.com/jmespath/jmespath.php.git","reference":"adcc9531682cf87dfda21e1fd5d0e7a41d292fac"},"dist":{"type":"zip","url":"https://api.github.com/repos/jmespath/jmespath.php/zipball/adcc9531682cf87dfda21e1fd5d0e7a41d292fac","reference":"adcc9531682cf87dfda21e1fd5d0e7a41d292fac","shasum":""},"require":{"php":">=5.4.0"},"require-dev":{"phpunit/phpunit":"~4.0"},"bin":["bin/jp.php"],"type":"library","extra":{"branch-alias":{"dev-master":"2.0-dev"}},"autoload":{"psr-4":{"JmesPath\":"src/"},"files":["src/JmesPath.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Michael Dowling","email":"mtdowling@gmail.com","homepage":"https://github.com/mtdowling"}],"description":"Declaratively specify how to extract elements from a JSON document","keywords":["json","jsonpath"],"time":"2016-12-03T22:08:25+00:00"},{"name":"psr/http-message","version":"1.0.1","source":{"type":"git","url":"https://github.com/php-fig/http-message.git","reference":"f6561bf28d520154e4b0ec72be95418abe6d9363"},"dist":{"type":"zip","url":"https://api.github.com/repos/php-fig/http-message/zipball/f6561bf28d520154e4b0ec72be95418abe6d9363","reference":"f6561bf28d520154e4b0ec72be95418abe6d9363","shasum":""},"require":{"php":">=5.3.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.0.x-dev"}},"autoload":{"psr-4":{"Psr\Http\Message\":"src/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"PHP-FIG","homepage":"http://www.php-fig.org/"}],"description":"Common interface for HTTP messages","homepage":"https://github.com/php-fig/http-message","keywords":["http","http-message","psr","psr-7","request","response"],"time":"2016-08-06T14:39:51+00:00"},{"name":"psr/log","version":"1.0.2","source":{"type":"git","url":"https://github.com/php-fig/log.git","reference":"4ebe3a8bf773a19edfe0a84b6585ba3d401b724d"},"dist":{"type":"zip","url":"https://api.github.com/repos/php-fig/log/zipball/4ebe3a8bf773a19edfe0a84b6585ba3d401b724d","reference":"4ebe3a8bf773a19edfe0a84b6585ba3d401b724d","shasum":""},"require":{"php":">=5.3.0"},"type":"library","extra":{"branch-alias":{"dev-master":"1.0.x-dev"}},"autoload":{"psr-4":{"Psr\Log\":"Psr/Log/"}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"PHP-FIG","homepage":"http://www.php-fig.org/"}],"description":"Common interface for logging libraries","homepage":"https://github.com/php-fig/log","keywords":["log","psr","psr-3"],"time":"2016-10-10T12:19:37+00:00"},{"name":"symfony/icu","version":"v1.2.2","target-dir":"Symfony/Component/Icu","source":{"type":"git","url":"https://github.com/symfony/icu.git","reference":"d4d85d6055b87f394d941b45ddd3a9173e1e3d2a"},"dist":{"type":"zip","url":"https://api.github.com/repos/symfony/icu/zipball/d4d85d6055b87f394d941b45ddd3a9173e1e3d2a","reference":"d4d85d6055b87f394d941b45ddd3a9173e1e3d2a","shasum":""},"require":{"ext-intl":"*","lib-icu":">=4.4","php":">=5.3.3","symfony/intl":"~2.3"},"type":"library","autoload":{"psr-0":{"Symfony\Component\Icu\":""}},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Symfony Community","homepage":"http://symfony.com/contributors"},{"name":"Bernhard Schussek","email":"bschussek@gmail.com"}],"description":"Contains an excerpt of the ICU data and classes to load it.","homepage":"http://symfony.com","keywords":["icu","intl"],"abandoned":"symfony/intl","time":"2014-07-25T09:58:17+00:00"},{"name":"symfony/symfony","version":"v2.3.1","source":{"type":"git","url":"https://github.com/symfony/symfony.git","reference":"0902c606b4df1161f5b786ae89f37b71380b1f23"},"dist":{"type":"zip","url":"https://api.github.com/repos/symfony/symfony/zipball/0902c606b4df1161f5b786ae89f37b71380b1f23","reference":"0902c606b4df1161f5b786ae89f37b71380b1f23","shasum":""},"require":{"doctrine/common":"~2.2","php":">=5.3.3","psr/log":"~1.0","symfony/icu":"~1.0","twig/twig":"~1.11"},"replace":{"symfony/browser-kit":"self.version","symfony/class-loader":"self.version","symfony/config":"self.version","symfony/console":"self.version","symfony/css-selector":"self.version","symfony/debug":"self.version","symfony/dependency-injection":"self.version","symfony/doctrine-bridge":"self.version","symfony/dom-crawler":"self.version","symfony/event-dispatcher":"self.version","symfony/filesystem":"self.version","symfony/finder":"self.version","symfony/form":"self.version","symfony/framework-bundle":"self.version","symfony/http-foundation":"self.version","symfony/http-kernel":"self.version","symfony/intl":"self.version","symfony/locale":"self.version","symfony/monolog-bridge":"self.version","symfony/options-resolver":"self.version","symfony/process":"self.version","symfony/propel1-bridge":"self.version","symfony/property-access":"self.version","symfony/proxy-manager-bridge":"self.version","symfony/routing":"self.version","symfony/security":"self.version","symfony/security-bundle":"self.version","symfony/serializer":"self.version","symfony/stopwatch":"self.version","symfony/swiftmailer-bridge":"self.version","symfony/templating":"self.version","symfony/translation":"self.version","symfony/twig-bridge":"self.version","symfony/twig-bundle":"self.version","symfony/validator":"self.version","symfony/web-profiler-bundle":"self.version","symfony/yaml":"self.version"},"require-dev":{"doctrine/data-fixtures":"1.0.*","doctrine/dbal":"~2.2","doctrine/orm":"~2.2,>=2.2.3","ircmaxell/password-compat":"1.0.*","monolog/monolog":"~1.3","ocramius/proxy-manager":">=0.3.1,<0.4-dev","propel/propel1":"1.6.*"},"type":"library","extra":{"branch-alias":{"dev-master":"2.3-dev"}},"autoload":{"psr-0":{"Symfony\":"src/"},"classmap":["src/Symfony/Component/HttpFoundation/Resources/stubs","src/Symfony/Component/Intl/Resources/stubs"],"files":["src/Symfony/Component/Intl/Resources/stubs/functions.php"]},"notification-url":"https://packagist.org/downloads/","license":["MIT"],"authors":[{"name":"Symfony Community","homepage":"http://symfony.com/contributors"},{"name":"Fabien Potencier","email":"fabien@symfony.com"}],"description":"The Symfony PHP framework","homepage":"http://symfony.com","keywords":["framework"],"time":"2013-06-11T11:46:38+00:00"},{"name":"twig/twig","version":"v1.35.0","source":{"type":"git","url":"https://github.com/twigphp/Twig.git","reference":"daa657073e55b0a78cce8fdd22682fddecc6385f"},"dist":{"type":"zip","url":"https://api.github.com/repos/twigphp/Twig/zipball/daa657073e55b0a78cce8fdd22682fddecc6385f","reference":"daa657073e55b0a78cce8fdd22682fddecc6385f","shasum":""},"require":{"php":">=5.3.3"},"require-dev":{"psr/container":"^1.0","symfony/debug":"~2.7","symfony/phpunit-bridge":"~3.3@dev"},"type":"library","extra":{"branch-alias":{"dev-master":"1.35-dev"}},"autoload":{"psr-0":{"Twig_":"lib/"},"psr-4":{"Twig\":"src/"}},"notification-url":"https://packagist.org/downloads/","license":["BSD-3-Clause"],"authors":[{"name":"Fabien Potencier","email":"fabien@symfony.com","homepage":"http://fabien.potencier.org","role":"Lead Developer"},{"name":"Armin Ronacher","email":"armin.ronacher@active-4.com","role":"Project Founder"},{"name":"Twig Team","homepage":"http://twig.sensiolabs.org/contributors","role":"Contributors"}],"description":"Twig, the flexible, fast, and secure template language for PHP","homepage":"http://twig.sensiolabs.org","keywords":["templating"],"time":"2017-09-27T18:06:46+00:00"},{"name":"yiisoft/yii","version":"1.1.14","source":{"type":"git","url":"https://github.com/yiisoft/yii.git","reference":"f0fee98ee84f70f1f3652f65562c9670e919cb4e"},"dist":{"type":"zip","url":"https://api.github.com/repos/yiisoft/yii/zipball/f0fee98ee84f70f1f3652f65562c9670e919cb4e","reference":"f0fee98ee84f70f1f3652f65562c9670e919cb4e","shasum":""},"require":{"php":">=5.1.0"},"bin":["framework/yiic"],"type":"library","notification-url":"https://packagist.org/downloads/","license":["BSD-3-Clause"],"authors":[{"name":"Qiang Xue","email":"qiang.xue@gmail.com","homepage":"http://www.yiiframework.com/","role":"Founder and project lead"},{"name":"Alexander Makarov","email":"sam@rmcreative.ru","homepage":"http://rmcreative.ru/","role":"Core framework development"},{"name":"Maurizio Domba","homepage":"http://mdomba.info/","role":"Core framework development"},{"name":"Carsten Brandt","email":"mail@cebe.cc","homepage":"http://cebe.cc/","role":"Core framework development"},{"name":"Wei Zhuo","email":"weizhuo@gmail.com","role":"Project site maintenance and development"},{"name":"Sebastián Thierer","email":"sebas@artfos.com","role":"Component development"},{"name":"Jeffrey Winesett","email":"jefftulsa@gmail.com","role":"Documentation and marketing"},{"name":"Timur Ruziev","email":"resurtm@gmail.com","homepage":"http://resurtm.com/","role":"Core framework development"},{"name":"Paul Klimov","email":"klimov.paul@gmail.com","role":"Core framework development"}],"description":"Yii Web Programming Framework","homepage":"http://www.yiiframework.com/","keywords":["framework","yii"],"time":"2013-08-12T00:12:08+00:00"},{"name":"zendframework/zendframework","version":"2.1.0","source":{"type":"git","url":"https://github.com/zendframework/zendframework.git","reference":"345a8cbedbe8de8a25bf18579fe54d169ac5075a"},"dist":{"type":"zip","url":"https://api.github.com/repos/zendframework/zendframework/zipball/345a8cbedbe8de8a25bf18579fe54d169ac5075a","reference":"345a8cbedbe8de8a25bf18579fe54d169ac5075a","shasum":""},"require":{"php":">=5.3.3"},"replace":{"zendframework/zend-authentication":"self.version","zendframework/zend-barcode":"self.version","zendframework/zend-cache":"self.version","zendframework/zend-captcha":"self.version","zendframework/zend-code":"self.version","zendframework/zend-config":"self.version","zendframework/zend-console":"self.version","zendframework/zend-crypt":"self.version","zendframework/zend-db":"self.version","zendframework/zend-debug":"self.version","zendframework/zend-di":"self.version","zendframework/zend-dom":"self.version","zendframework/zend-escaper":"self.version","zendframework/zend-eventmanager":"self.version","zendframework/zend-feed":"self.version","zendframework/zend-file":"self.version","zendframework/zend-filter":"self.version","zendframework/zend-form":"self.version","zendframework/zend-http":"self.version","zendframework/zend-i18n":"self.version","zendframework/zend-inputfilter":"self.version","zendframework/zend-json":"self.version","zendframework/zend-ldap":"self.version","zendframework/zend-loader":"self.version","zendframework/zend-log":"self.version","zendframework/zend-mail":"self.version","zendframework/zend-math":"self.version","zendframework/zend-memory":"self.version","zendframework/zend-mime":"self.version","zendframework/zend-modulemanager":"self.version","zendframework/zend-mvc":"self.version","zendframework/zend-navigation":"self.version","zendframework/zend-paginator":"self.version","zendframework/zend-permissions-acl":"self.version","zendframework/zend-permissions-rbac":"self.version","zendframework/zend-progressbar":"self.version","zendframework/zend-serializer":"self.version","zendframework/zend-server":"self.version","zendframework/zend-servicemanager":"self.version","zendframework/zend-session":"self.version","zendframework/zend-soap":"self.version","zendframework/zend-stdlib":"self.version","zendframework/zend-tag":"self.version","zendframework/zend-test":"self.version","zendframework/zend-text":"self.version","zendframework/zend-uri":"self.version","zendframework/zend-validator":"self.version","zendframework/zend-version":"self.version","zendframework/zend-view":"self.version","zendframework/zend-xmlrpc":"self.version"},"require-dev":{"doctrine/common":">=2.1","phpunit/phpunit":"3.7.*"},"suggest":{"doctrine/common":"Doctrine\Common >=2.1 for annotation features","ext-intl":"ext/intl for i18n features","pecl-weakref":"Implementation of weak references for Zend\Stdlib\CallbackHandler","zendframework/zendpdf":"ZendPdf for creating PDF representations of barcodes","zendframework/zendservice-recaptcha":"ZendService\ReCaptcha for rendering ReCaptchas in Zend\Captcha and/or Zend\Form"},"bin":["bin/classmap_generator.php"],"type":"library","extra":{"branch-alias":{"dev-master":"2.1-dev","dev-develop":"2.2-dev"}},"autoload":{"psr-0":{"Zend\":"library/","ZendTest\":"tests/"}},"notification-url":"https://packagist.org/downloads/","license":["BSD-3-Clause"],"description":"Zend Framework 2","homepage":"http://framework.zend.com/","keywords":["framework","zf2"],"time":"2013-01-30T16:46:21+00:00"}],"packages-dev":[],"aliases":[],"minimum-stability":"stable","stability-flags":[],"prefer-stable":false,"prefer-lowest":false,"platform":{"php":">=5.3.2"},"platform-dev":[]}'
    DepGraphData:
      title: DepGraphData
      required:
        - schemaVersion
        - pkgManager
        - pkgs
        - graph
      type: object
      properties:
        schemaVersion:
          type: string
          description: Snyk DepGraph library schema version.
        pkgManager:
          $ref: '#/components/schemas/PkgManager'
        pkgs:
          type: array
          items:
            $ref: '#/components/schemas/Package'
          description: Array of package dependencies.
        graph:
          $ref: '#/components/schemas/Graph'
    PkgManager:
      title: PkgManager
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: Package manager name.
        repositories:
          type: array
          items:
            $ref: '#/components/schemas/Repository'
          description: A list of package repositories (i.e. maven-central, or npm) that defaults to the canonical package registry for the given package manager.
    Repository:
      title: Repository
      type: object
      properties:
        alias:
          type: string
          description: deb, apk and rpm package managers should use an alias to indicate the target Operating System, for example 'debian:10'.
    Package:
      title: Package
      required:
        - id
        - info
      type: object
      properties:
        id:
          type: string
          description: Unique package identifier, should take the format name@version.
        info:
          $ref: '#/components/schemas/PackageInfo'
    PackageInfo:
      title: PackageInfo
      required:
        - name
        - version
      type: object
      properties:
        name:
          type: string
          description: Package name.
        version:
          type: string
          description: Package version.
    Graph:
      title: Graph
      required:
        - rootNodeId
        - nodes
      type: object
      properties:
        rootNodeId:
          type: string
          description: Root node id.
        nodes:
          type: array
          items:
            $ref: '#/components/schemas/Node'
          description: Array of node objects.
    Node:
      title: Node
      required:
        - nodeId
        - pkgId
      type: object
      properties:
        nodeId:
          type: string
          description: Node id unique across the graph.
        pkgId:
          type: string
          description: Package id reference should match id in pkg array and take the format name@version.
        deps:
          type: array
          items:
            $ref: '#/components/schemas/GraphDependency'
          description: An array of package ids this package depends on.
    GraphDependency:
      title: GraphDependency
      required:
        - nodeId
      type: object
      properties:
        nodeId:
          type: string
          description: Node id unique across the graph.
    monitorgraphpayload:
      title: monitorgraphpayload
      required:
        - depGraph
      type: object
      properties:
        depGraph:
          $ref: '#/components/schemas/MonitorDepGraphData'
        meta:
          $ref: '#/components/schemas/MonitorMetaData'
    MonitorDepGraphData:
      title: MonitorDepGraphData
      required:
        - schemaVersion
        - pkgManager
        - pkgs
        - graph
      type: object
      properties:
        schemaVersion:
          type: string
          description: Snyk DepGraph library schema version.
        pkgManager:
          $ref: '#/components/schemas/MonitorPkgManager'
        pkgs:
          type: array
          items:
            $ref: '#/components/schemas/MonitorPackage'
          description: Array of package dependencies.
        graph:
          $ref: '#/components/schemas/MonitorGraph'
    MonitorMetaData:
      title: MonitorMetaData
      type: object
      properties:
        targetFramework:
          type: string
          description: Required for a NuGet or Paket DepGraph only. Specify the target framework in your project file using Target Framework Monikers (TFMs). For example, netstandard1.0, netcoreapp1.0 or net452. Test each framework separately if you have multiple defined.
    MonitorPkgManager:
      title: MonitorPkgManager
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: Package manager name.
        repositories:
          type: array
          items:
            $ref: '#/components/schemas/MonitorRepository'
          description: A list of package repositories (i.e. maven-central, or npm) that defaults to the canonical package registry for the given package manager.
    MonitorRepository:
      title: MonitorRepository
      type: object
      properties:
        alias:
          type: string
          description: deb, apk and rpm package managers should use an alias to indicate the target Operating System, for example 'debian:10'.
    MonitorPackage:
      title: MonitorPackage
      required:
        - id
        - info
      type: object
      properties:
        id:
          type: string
          description: Unique package identifier, should take the format name@version.
        info:
          $ref: '#/components/schemas/MonitorPackageInfo'
    MonitorPackageInfo:
      title: MonitorPackageInfo
      required:
        - name
        - version
      type: object
      properties:
        name:
          type: string
          description: Package name.
        version:
          type: string
          description: Package version.
    MonitorGraph:
      title: MonitorGraph
      required:
        - rootNodeId
        - nodes
      type: object
      properties:
        rootNodeId:
          type: string
          description: Root node id. Note the root node name is used as your project name.
        nodes:
          type: array
          items:
            $ref: '#/components/schemas/MonitorNode'
          description: Array of node objects.
    MonitorNode:
      title: MonitorNode
      required:
        - nodeId
        - pkgId
      type: object
      properties:
        nodeId:
          type: string
          description: Node id unique across the graph.
        pkgId:
          type: string
          description: Package id reference should match id in pkg array and take the format name@version.
        deps:
          type: array
          items:
            $ref: '#/components/schemas/MonitorGraphDependency'
          description: An array of package ids this package depends on.
    MonitorGraphDependency:
      title: MonitorGraphDependency
      required:
        - nodeId
      type: object
      properties:
        nodeId:
          type: string
          description: Node id unique across the graph.
    PriorityScore:
      title: PriorityScore
      type: object
      properties:
        min:
          type: number
          example: 0
        max:
          type: number
          example: 1000
    IssuesFilters:
      title: IssuesFilters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/filters6'
    IssueCountsFilters:
      title: IssueCountsFilters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/filters7'
    ProjectCountsFilters:
      title: ProjectCountsFilters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/filters8'
    TestsFilters:
      title: TestsFilters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/filters9'
    Issues:
      title: Issues
      required:
        - results
        - total
      type: object
      properties:
        results:
          type: array
          items:
            oneOf:
              - type: array
                items:
                  $ref: '#/components/schemas/projects2'
              - $ref: '#/components/schemas/project1'
          description: A list of issues
        total:
          type: number
          description: The total number of results found
    IssueCounts:
      title: IssueCounts
      required:
        - results
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/results3'
          description: A list of issue counts by day
    ProjectCounts:
      title: ProjectCounts
      required:
        - results
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/results4'
          description: A list of project counts by day
    TestCounts:
      title: TestCounts
      required:
        - results
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/results5'
          description: A list of test counts
    ErrorResponse:
      title: ErrorResponse
      required:
        - code
        - ok
        - error
      type: object
      properties:
        code:
          type: number
          description: The error response code
          example: 400
        ok:
          type: boolean
        error:
          $ref: '#/components/schemas/error'
    Orgsettingsresponse:
      title: Orgsettingsresponse
      type: object
      properties:
        requestAccess:
          allOf:
            - $ref: '#/components/schemas/requestAccess1'
            - $ref: '#/components/schemas/orgIgnoreSettings'
            - description: Will only be returned if `API_KEY` has read access to request access settings.
    Orgsettingsrequest:
      title: Orgsettingsrequest
      type: object
      properties:
        requestAccess:
          allOf:
            - $ref: '#/components/schemas/requestAccess2'
            - description: Can only be updated if `API_KEY` has edit access to request access settings.
    Notificationsettingsrequest:
      title: Notificationsettingsrequest
      type: object
      properties:
        new-issues-remediations:
          $ref: '#/components/schemas/Newissuesnotificationsettingrequest'
        project-imported:
          $ref: '#/components/schemas/Simplenotificationsettingrequest'
        test-limit:
          $ref: '#/components/schemas/Simplenotificationsettingrequest'
        weekly-report:
          $ref: '#/components/schemas/Simplenotificationsettingrequest'
        request-updates:
          required:
            - enabled
          type: object
          properties:
            enabled:
              type: boolean
              description: Whether Ignore Approval Workflow Request Update notifications should be sent
              example: true
        pending-requests:
          required:
            - enabled
          type: object
          properties:
            enabled:
              type: boolean
              description: Whether Ignore Approval Workflow Pending Requests notifications should be sent
              example: true
    Notificationsettingsresponse:
      title: Notificationsettingsresponse
      type: object
      properties:
        new-issues-remediations:
          $ref: '#/components/schemas/Notificationsettingresponse'
        project-imported:
          $ref: '#/components/schemas/Simplenotificationsettingresponse'
        test-limit:
          $ref: '#/components/schemas/Simplenotificationsettingresponse'
        weekly-report:
          $ref: '#/components/schemas/Simplenotificationsettingresponse'
        request-updates:
          $ref: '#/components/schemas/Simplenotificationsettingresponse'
        pending-requests:
          $ref: '#/components/schemas/Simplenotificationsettingresponse'
    Newissuesnotificationsettingrequest:
      title: Newissuesnotificationsettingrequest
      required:
        - enabled
        - issueSeverity
        - issueType
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether notifications should be sent
          example: true
        issueSeverity:
          allOf:
            - $ref: '#/components/schemas/issueSeverity'
            - description: The severity levels of issues to send notifications for (only applicable for `new-remediations-vulnerabilities` notificationType)
              example: high
        issueType:
          allOf:
            - $ref: '#/components/schemas/issueType'
            - description: Filter the types of issue to include in notifications (only applicable for `new-remediations-vulnerabilities` notificationType)
              example: vuln
    Simplenotificationsettingrequest:
      title: Simplenotificationsettingrequest
      required:
        - enabled
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether notifications should be sent
          example: true
    Notificationsettingresponse:
      title: Notificationsettingresponse
      allOf:
        - $ref: '#/components/schemas/Newissuesnotificationsettingrequest'
        - type: object
          properties:
            inherited:
              type: boolean
              description: Whether the setting was found on the requested context directly or inherited from a parent
    Simplenotificationsettingresponse:
      title: Simplenotificationsettingresponse
      allOf:
        - $ref: '#/components/schemas/Simplenotificationsettingrequest'
        - type: object
          properties:
            inherited:
              type: boolean
              description: Whether the setting was found on the requested context directly or inherited from a parent
    Tag:
      title: Tag
      type: object
      properties:
        key:
          type: string
          description: Alphanumeric including - and _ with a limit of 30 characters
          example: example-tag-key
        value:
          type: string
          description: Alphanumeric including - and _ with a limit of 50 characters
          example: example-tag-value
    Integrations:
      title: Integrations
      type: object
      properties:
        key:
          type: string
          description: The name of an integration
          example: github
        value:
          type: string
          description: Alphanumeric UUID including - with a limit of 36 characters
          example: 9a3e5d90-b782-468a-a042-9a2073736f0b
    PullRequestAssignment:
      title: PullRequestAssignment
      type: object
      properties:
        enabled:
          type: boolean
          description: if the organization's project(s) will assign Snyk pull requests.
        type:
          $ref: '#/components/schemas/AssignmentType'
        assignees:
          type: array
          items:
            type: string
          description: an array of usernames that have contributed to the organization's project(s).
    AutoRemediationPrs:
      title: AutoRemediationPrs
      type: object
      properties:
        freshPrsEnabled:
          type: boolean
          description: If true, allows automatic remediation of newly identified issues, or older issues where a fix has been identified
        backlogPrsEnabled:
          type: boolean
          description: If true, allows automatic remediation of prioritized backlog issues
        backlogPrStrategy:
          allOf:
            - $ref: '#/components/schemas/backlogPrStrategy'
            - description: Determine which issues are fixed in a backlog PR
        usePatchRemediation:
          type: boolean
          description: If true, allows using patched remediation
    AssignmentType:
      title: AssignmentType
      enum:
        - auto
        - manual
      type: string
    Projectattributes:
      title: Projectattributes
      type: object
      properties:
        criticality:
          type: array
          items:
            $ref: '#/components/schemas/criticality'
          description: ''
        environment:
          type: array
          items:
            $ref: '#/components/schemas/environment'
          description: ''
        lifecycle:
          type: array
          items:
            $ref: '#/components/schemas/lifecycle'
          description: ''
    AcrCredentials:
      title: AcrCredentials
      required:
        - username
        - password
        - registryBase
      type: object
      properties:
        username:
          type: string
        password:
          type: string
        registryBase:
          type: string
          description: 'e.g.: `name.azurecr.io`'
    Addatagtoaprojectresponse:
      title: Addatagtoaprojectresponse
      type: object
      properties:
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: Tags now applied to the project
    AddNewIntegrationWithCredentialsRequest:
      title: Add New Integration With Credentials Request
      required:
        - type
        - credentials
      type: object
      properties:
        type:
          $ref: '#/components/schemas/IntegrationType'
        credentials:
          $ref: '#/components/schemas/IntegrationCredentials'
    AddNewIntegrationWithBrokerRequest:
      title: Add New Integration With Broker Request
      required:
        - type
        - broker
      type: object
      properties:
        type:
          $ref: '#/components/schemas/IntegrationType'
        broker:
          $ref: '#/components/schemas/BrokerSettings'
    Addnewintegrationresponse:
      title: Addnewintegrationresponse
      required:
        - id
      type: object
      properties:
        id:
          type: string
      example:
        id: 9a3e5d90-b782-468a-a042-9a2073736f0b
    Addnewintegrationresponse1:
      title: Addnewintegrationresponse1
      required:
        - id
        - brokerToken
      type: object
      properties:
        id:
          type: string
        brokerToken:
          type: string
      example:
        id: 9a3e5d90-b782-468a-a042-9a2073736f0b
        brokerToken: 4a18d42f-0706-4ad0-b127-24078731fbed
    Applyingattributesresponse:
      title: Applyingattributesresponse
      type: object
      properties:
        attributes:
          $ref: '#/components/schemas/Projectattributes'
    ArtifactoryCrCredentials:
      title: ArtifactoryCrCredentials
      required:
        - username
        - password
        - registryBase
      type: object
      properties:
        username:
          type: string
        password:
          type: string
        registryBase:
          type: string
          description: 'e.g.: `name.jfrog.io`'
    autoRemediationPrs2:
      title: autoRemediationPrs2
      type: object
      properties:
        backlogPrsEnabled:
          type: boolean
          description: If true, allows automatic remediation of prioritized backlog issues
        backlogPrStrategy:
          allOf:
            - $ref: '#/components/schemas/backlogPrStrategy'
            - description: Determine which issues are fixed in a backlog PR
        freshPrsEnabled:
          type: boolean
          description: If true, allows automatic remediation of newly identified issues, or older issues where a fix has been identified
        usePatchRemediation:
          type: boolean
          description: If true, allows using patched remediation
      description: Defines automatic remediation policies
    AzureReposCredentials:
      title: AzureReposCredentials
      required:
        - token
        - url
      type: object
      properties:
        token:
          type: string
        url:
          type: string
    backlogPrStrategy:
      title: backlogPrStrategy
      enum:
        - vuln
        - dependency
      type: string
      description: Determine which issues are fixed in a backlog PR
    BitbucketCloudCredentials:
      title: BitbucketCloudCredentials
      required:
        - username
        - password
      type: object
      properties:
        username:
          type: string
        password:
          type: string
    BitbucketServerCredentials:
      title: BitbucketServerCredentials
      required:
        - username
        - password
        - url
      type: object
      properties:
        username:
          type: string
        password:
          type: string
        url:
          type: string
    Cloneanintegrationwithsettingsandcredentialsrequest:
      title: Cloneanintegrationwithsettingsandcredentialsrequest
      required:
        - destinationOrgPublicId
      type: object
      properties:
        destinationOrgPublicId:
          type: string
          description: The organization public ID. The `API_KEY` must have access to this organization.
    Cloneanintegrationwithsettingsandcredentialsresponse:
      title: Cloneanintegrationwithsettingsandcredentialsresponse
      required:
        - newIntegrationId
      type: object
      properties:
        newIntegrationId:
          type: string
      example:
        newIntegrationId: 9a3e5d90-b782-468a-a042-9a2073736f0b
    Createaneworganizationresponse:
      title: Createaneworganizationresponse
      required:
        - id
        - name
        - slug
        - url
        - created
        - group
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        slug:
          type: string
        url:
          type: string
        created:
          type: string
        group:
          $ref: '#/components/schemas/Group1'
      example:
        id: 0356f641-c55c-488f-af05-c2122590f369
        name: new-org
        slug: new-org
        url: https://api.snyk.io/v1/org/new-org
        created: 2021-01-07T16:07:16.237Z
        group:
          name: test-group
          id: 4a18d42f-0706-4ad0-b127-24078731fbed
    Createaneworganizationresponse1:
      title: Createaneworganizationresponse1
      type: object
      properties:
        message:
          type: string
          description: The error message
        errorRef:
          type: string
          description: '[UUID] An error ref to contact Snyk with'
    Createawebhookresponse:
      title: Createawebhookresponse
      required:
        - id
        - url
      type: object
      properties:
        id:
          type: string
        url:
          type: string
      example:
        id: d3cf26b3-2d77-497b-bce2-23b33cc15362
        url: https://my.app.com/webhook-handler/snyk123
    criticality:
      title: criticality
      enum:
        - critical
        - high
        - medium
        - low
      type: string
    dependencies1:
      title: dependencies1
      required:
        - id
        - name
        - version
        - packageManager
      type: object
      properties:
        id:
          type: string
          description: The identifier of the package
        name:
          type: string
          description: The name of the package
        version:
          type: string
          description: The version of the package
        packageManager:
          type: string
          description: The package manager of the dependency
    depGraph:
      title: depGraph
      required:
        - schemaVersion
        - pkgManager
        - pkgs
        - graph
      type: object
      properties:
        schemaVersion:
          type: string
          description: The scheme version of the depGraph object
        pkgManager:
          $ref: '#/components/schemas/pkgManager2'
        pkgs:
          type: array
          items:
            $ref: '#/components/schemas/pkgs'
          description: A list of dependencies in the project
        graph:
          $ref: '#/components/schemas/graph2'
      description: The dependency-graph object
    deps:
      title: deps
      required:
        - nodeId
      type: object
      properties:
        nodeId:
          type: string
          description: The id of the node
    DigitalOceanCrCredentials:
      title: DigitalOceanCrCredentials
      required:
        - token
      type: object
      properties:
        token:
          type: string
          description: Personal Access Token
    DockerHubCredentials:
      title: DockerHubCredentials
      required:
        - username
        - password
      type: object
      properties:
        username:
          type: string
        password:
          type: string
          description: Access Token
    EcrCredentials:
      title: EcrCredentials
      required:
        - region
        - roleArn
      type: object
      properties:
        region:
          type: string
          description: 'e.g.: `eu-west-3`'
        roleArn:
          type: string
          description: 'e.g.: `arn:aws:iam::<account-id>:role/<newRole>`'
    encoding:
      title: encoding
      enum:
        - plain
        - base64
      type: string
      description: the encoding for the manifest files sent.
    entitlementKey:
      title: entitlementKey
      enum:
        - licenses
        - reports
        - fullVulnDB
      type: string
    environment:
      title: environment
      enum:
        - frontend
        - backend
        - internal
        - external
        - mobile
        - saas
        - onprem
        - hosted
        - distributed
      type: string
    error:
      title: error
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: A descriptive message of the error
        innerErrors:
          type: array
          items:
            type: string
          description: A list of additional reasons why the error occurred
    fields:
      title: fields
      type: object
      properties:
        project:
          type: object
          description: See https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-issues/#api-rest-api-3-issue-post for details of what to send as fields.
        issuetype:
          type: object
          description: See https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-issues/#api-rest-api-3-issue-post for details of what to send as fields.
        summary:
          type: string
          description: See https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-issues/#api-rest-api-3-issue-post for details of what to send as fields.
    files:
      title: files
      required:
        - target
      type: object
      properties:
        target:
          $ref: '#/components/schemas/MavenFile'
        additional:
          type: array
          items:
            $ref: '#/components/schemas/MavenAdditionalFile'
          description: additional manifest files (if needed), encoded according the the "encoding" field.
      description: 'The manifest files:'
    files1:
      title: files1
      required:
        - target
      type: object
      properties:
        target:
          allOf:
            - $ref: '#/components/schemas/target'
            - description: the `vendor.json` file, encoded according the the "encoding" field.
      description: 'The manifest files:'
    files2:
      title: files2
      required:
        - target
        - additional
      type: object
      properties:
        target:
          allOf:
            - $ref: '#/components/schemas/target1'
            - description: the `Gopkg.toml` file, encoded according the the "encoding" field.
        additional:
          type: array
          items:
            $ref: '#/components/schemas/GoPkgLock'
          description: a lockfile encoded according the the "encoding" field.
      description: 'The manifest files:'
    files3:
      title: files3
      required:
        - target
      type: object
      properties:
        target:
          allOf:
            - $ref: '#/components/schemas/target2'
            - description: the `package.json` file, encoded according the the "encoding" field.
        additional:
          type: array
          items:
            $ref: '#/components/schemas/PackageLockJsonFile'
          description: a lockfile can be sent (if needed), encoded according the the "encoding" field.
      description: 'The manifest files:'
    files4:
      title: files4
      required:
        - target
      type: object
      properties:
        target:
          allOf:
            - $ref: '#/components/schemas/target2'
            - description: the `package.json` file, encoded according the the "encoding" field.
        additional:
          type: array
          items:
            $ref: '#/components/schemas/YarnLockFile'
          description: a lockfile can be sent (if needed), encoded according the the "encoding" field.
      description: 'The manifest files:'
    files5:
      title: files5
      required:
        - target
      type: object
      properties:
        target:
          allOf:
            - $ref: '#/components/schemas/target4'
            - description: the `Gemfile.lock` file, encoded according the the "encoding" field.
      description: 'The manifest files:'
    files6:
      title: files6
      required:
        - target
      type: object
      properties:
        target:
          $ref: '#/components/schemas/GradleFile'
      description: 'The manifest files:'
    files7:
      title: files7
      required:
        - target
      type: object
      properties:
        target:
          $ref: '#/components/schemas/SBTFile'
      description: 'The manifest files:'
    files8:
      title: files8
      required:
        - target
      type: object
      properties:
        target:
          allOf:
            - $ref: '#/components/schemas/target5'
            - description: the `requirements.txt` file, encoded according the the "encoding" field.
      description: 'The manifest files:'
    files9:
      title: files9
      required:
        - target
        - additional
      type: object
      properties:
        target:
          allOf:
            - $ref: '#/components/schemas/target6'
            - description: the `composer.json` file, encoded according the the "encoding" field.
        additional:
          type: array
          items:
            $ref: '#/components/schemas/ComposerLock'
          description: a lockfile encoded according the the "encoding" field.
      description: 'The manifest files:'
    ImportFiles:
      title: ImportFiles
      type: object
      properties:
        path:
          type: string
          description: relative path to the file
          example: example/package.json
    filters:
      title: filters
      type: object
      properties:
        name:
          type: string
          description: If supplied, only projects that have a name that **starts with** this value will be returned
          example: snyk/goof
        origin:
          type: string
          description: If supplied, only projects that exactly match this origin will be returned
          example: github
        type:
          type: string
          description: If supplied, only projects that exactly match this type will be returned
          example: maven
        isMonitored:
          type: boolean
          description: If set to `true`, only include projects which are monitored, if set to `false`, only include projects which are not monitored
        tags:
          $ref: '#/components/schemas/tags'
        attributes:
          type: string
          description: >-
            When you filter by multiple values on a single attribute, you will return projects that have been assigned one or more of the values in the filter.


            When you filter by multiple attributes, you will return projects which have been assigned values of both attributes in the filter.
    aggregatedProjectIssuesfilter:
      title: aggregatedProjectIssuesFilter
      type: object
      properties:
        severities:
          type: array
          items:
            type: string
          description: The severity levels of issues to filter the results by
        exploitMaturity:
          type: array
          items:
            type: string
          description: The exploit maturity levels of issues to filter the results by (Non-IaC projects only)
        types:
          type: array
          items:
            type: string
          description: The type of issues to filter the results by (Non-IaC projects only)
        ignored:
          type: boolean
          description: If set to `true`, only include issues which are ignored, if set to `false`, only include issues which are not ignored
        patched:
          type: boolean
          description: If set to `true`, only include issues which are patched, if set to `false`, only include issues which are not patched (Non-IaC projects only)
        priority:
          $ref: '#/components/schemas/priority1'
    filters2:
      title: filters2
      type: object
      properties:
        imageId:
          type: string
          description: For container projects, filter by the ID of the image
          example: sha256:caf27325b298a6730837023a8a342699c8b7b388b8d878966b064a1320043019
    filters3:
      title: filters3
      type: object
      properties:
        severities:
          type: array
          items:
            type: string
          description: The severity levels of issues to filter the results by
        exploitMaturity:
          type: array
          items:
            type: string
          description: The exploit maturity levels of issues to filter the results by
        types:
          type: array
          items:
            type: string
          description: The type of issues to filter the results by
        ignored:
          type: boolean
          description: If set to `true`, only include issues which are ignored, if set to `false`, only include issues which are not ignored
        patched:
          type: boolean
          description: If set to `true`, only include issues which are patched, if set to `false`, only include issues which are not patched
        priorityScore:
          allOf:
            - $ref: '#/components/schemas/priorityScore2'
            - description: Include issues that have a priority score between `min` and `max`
    filters4:
      title: filters4
      type: object
      properties:
        languages:
          type: array
          items:
            type: string
          description: The type of languages to filter the results by
        projects:
          type: array
          items:
            type: string
          description: The list of project IDs to filter the results by
        dependencies:
          type: array
          items:
            type: string
          description: The list of dependency IDs to filter the results by (i.e amdefine@1.0.1 or org.javassist:javassist@3.18.1-GA)
        licenses:
          type: array
          items:
            type: string
          description: The list of license IDs to filter the results by
        severity:
          type: array
          items:
            type: string
          description: The severities to filter the results by
        depStatus:
          type: string
          description: 'Status of the dependency. Requires reporting entitlement. Options: `deprecated` - Include only deprecated packages; `notDeprecated` - Include all packages that are not marked as deprecated; `any` - Include all packages (default)'
    filters5:
      title: filters5
      type: object
      properties:
        languages:
          type: array
          items:
            type: string
          description: The type of languages to filter the results by
        projects:
          type: array
          items:
            type: string
          description: The list of project IDs to filter the results by
        dependencies:
          type: array
          items:
            type: string
          description: The list of dependency IDs to filter the results by
        licenses:
          type: array
          items:
            type: string
          description: The list of license IDs to filter the results by
        severity:
          type: array
          items:
            type: string
          description: The severities to filter the results by
    filters6:
      title: filters6
      required:
        - orgs
      type: object
      properties:
        orgs:
          type: array
          items:
            type: string
          description: The list of org IDs to filter the results by
        severity:
          type: array
          items:
            type: string
          description: The severity levels of issues to filter the results by
        exploitMaturity:
          type: array
          items:
            type: string
          description: The exploit maturity levels of issues to filter the results by
        types:
          type: array
          items:
            type: string
          description: The type of issues to filter the results by
        languages:
          type: array
          items:
            type: string
          description: The type of languages to filter the results by
        projects:
          type: array
          items:
            type: string
          description: The list of project IDs to filter issues by, max projects allowed is 1000
        issues:
          type: array
          items:
            type: string
          description: The list of issue IDs to filter issues by
        identifier:
          type: string
          description: Search term to filter issue name by, or an exact CVE or CWE
        ignored:
          type: boolean
          description: If set to `true`, only include issues which are ignored, if set to `false`, only include issues which are not ignored
        patched:
          type: boolean
          description: If set to `true`, only include issues which are patched, if set to `false`, only include issues which are not patched
        fixable:
          type: boolean
          description: If set to `true`, only include issues which are fixable, if set to `false`, only include issues which are not fixable. An issue is fixable if it is either upgradable, patchable or pinnable. Also see isUpgradable, isPatchable and isPinnable filters.
        isFixed:
          type: boolean
          description: If set to `true`, only include issues which are fixed, if set to `false`, only include issues which are not fixed
        isUpgradable:
          type: boolean
          description: If set to `true`, only include issues which are upgradable, if set to `false`, only include issues which are not upgradable
        isPatchable:
          type: boolean
          description: If set to `true`, only include issues which are patchable, if set to `false`, only include issues which are not patchable
        isPinnable:
          type: boolean
          description: If set to `true`, only include issues which are pinnable, if set to `false`, only include issues which are not pinnable
        priorityScore:
          $ref: '#/components/schemas/PriorityScore'
    filters7:
      title: filters7
      required:
        - orgs
      type: object
      properties:
        orgs:
          type: array
          items:
            type: string
          description: The list of org IDs to filter the results by
        severity:
          type: array
          items:
            type: string
          description: The severity levels of issues to filter the results by
        types:
          type: array
          items:
            type: string
          description: The type of issues to filter the results by
        languages:
          type: array
          items:
            type: string
          description: The type of languages to filter the results by
        projects:
          type: array
          items:
            type: string
          description: The list of project IDs to filter issues by, max projects allowed is 1000
        ignored:
          type: boolean
          description: If set to `true`, only include issues which are ignored, if set to `false`, only include issues which are not ignored
        patched:
          type: boolean
          description: If set to `true`, only include issues which are patched, if set to `false`, only include issues which are not patched
        fixable:
          type: boolean
          description: If set to `true`, only include issues which are fixable, if set to `false`, only include issues which are not fixable. An issue is fixable if it is either upgradable, patchable or pinnable. Also see isUpgradable, isPatchable and isPinnable filters.
        isUpgradable:
          type: boolean
          description: If set to `true`, only include issues which are upgradable, if set to `false`, only include issues which are not upgradable
        isPatchable:
          type: boolean
          description: If set to `true`, only include issues which are patchable, if set to `false`, only include issues which are not patchable
        isPinnable:
          type: boolean
          description: If set to `true`, only include issues which are pinnable, if set to `false`, only include issues which are not pinnable
        priorityScore:
          $ref: '#/components/schemas/PriorityScore'
    filters8:
      title: filters8
      required:
        - orgs
      type: object
      properties:
        orgs:
          type: array
          items:
            type: string
          description: The list of org IDs to filter the results by
        languages:
          type: array
          items:
            type: string
          description: The type of languages to filter the results by
        projects:
          type: array
          items:
            type: string
          description: The list of project IDs to filter the results by, max projects allowed is 1000
    filters9:
      title: filters9
      required:
        - orgs
      type: object
      properties:
        orgs:
          type: array
          items:
            type: string
          description: The list of org IDs to filter the results by
        isPrivate:
          type: boolean
          description: If set to `true`, only include tests which were conducted against private projects, if set to `false` only include tests which were conducted against public projects
        issuesPrevented:
          type: boolean
          description: If set to `true`, only include tests which prevented issues from being introduced, if set to `false` only include tests which did not prevent issues from being introduced
        projects:
          type: array
          items:
            type: string
          description: The list of project IDs to filter issues by, max projects allowed is 1000
    Filters12:
      title: Filters12
      required:
        - types
      type: object
      properties:
        types:
          type: array
          items:
            type: string
          description: ''
      example:
        types:
          - unsupported-type
    Filters16:
      title: Filters16
      required:
        - projects
      type: object
      properties:
        projects:
          type: array
          items:
            type: string
          description: ''
      example:
        projects:
          - unsupported-project
    Filters18:
      title: Filters18
      required:
        - isPrivate
      type: object
      properties:
        isPrivate:
          type: string
      example:
        isPrivate: non-boolean-value
    fixable:
      title: fixable
      type: object
      properties:
        'true':
          type: number
          description: The number of fixable issues
        'false':
          type: number
          description: The number of non-fixable issues
    fixInfo:
      title: fixInfo
      type: object
      properties:
        isUpgradable:
          type: boolean
          description: Whether all of the issue's paths are upgradable
        isPinnable:
          type: boolean
          description: Whether the issue can be fixed by pinning a transitive
        isPatchable:
          type: boolean
          description: Whether all the of issue's paths are patchable
        isFixable:
          type: boolean
          description: Whether all of the issue's paths are fixable. Paths that are already patched are not considered fixable unless they have an alternative remediation (e.g. pinning or upgrading). An upgrade path where the only changes are in transitive dependencies is only considered fixable if the package manager supports it.
        isPartiallyFixable:
          type: boolean
          description: Whether any of the issue's paths can be fixed. Paths that are already patched are not considered fixable unless they have an alternative remediation (e.g. pinning or upgrading).  An upgrade path where the only changes are in transitive dependencies is only considered fixable if the package manager supports it.
        nearestFixedInVersion:
          type: string
          description: Nearest version which includes a fix for the issue. This is populated for container projects only.
          example: 2.0.0
        fixedIn:
          type: array
          items:
            type: string
          description: The set of versions in which this issue has been fixed. If the issue spanned multiple versions (i.e. `1.x` and `2.x`) then there will be multiple `fixedIn` entries
      description: Information about fix/upgrade/pinnable options for the issue (Non-IaC projects only)
    Function1:
      title: Function1
      type: object
      properties:
        functionId:
          $ref: '#/components/schemas/FunctionId1'
        version:
          type: array
          items:
            type: string
          description: ''
    Function2:
      title: Function2
      required:
        - functionId
        - version
      type: object
      properties:
        functionId:
          $ref: '#/components/schemas/FunctionId3'
        version:
          type: array
          items:
            type: string
          description: ''
      example:
        functionId:
          filePath: ms.js
          functionName: parse
        version:
          - '>0.1.0 <=0.3.0'
    Function3:
      title: Function3
      type: object
      properties:
        functionId:
          $ref: '#/components/schemas/FunctionId3'
        version:
          type: array
          items:
            type: string
          description: ''
    Function11:
      title: Function11
      required:
        - functionId
        - version
      type: object
      properties:
        functionId:
          $ref: '#/components/schemas/FunctionId1'
        version:
          type: array
          items:
            type: string
          description: ''
      example:
        functionId:
          className: org.apache.zookeeper.server.NIOServerCnxn
          functionName: checkFourLetterWord
        version:
          - '[,3.3.7)'
    FunctionId1:
      title: FunctionId1
      required:
        - className
        - functionName
      type: object
      properties:
        className:
          type: string
        functionName:
          type: string
      example:
        className: org.apache.zookeeper.server.NIOServerCnxn
        functionName: checkFourLetterWord
    FunctionId3:
      title: FunctionId3
      required:
        - filePath
        - functionName
      type: object
      properties:
        filePath:
          type: string
        functionName:
          type: string
      example:
        filePath: ms.js
        functionName: parse
    GcrCredentials:
      title: GcrCredentials
      required:
        - password
        - registryBase
      type: object
      properties:
        password:
          type: string
          description: JSON key file
        registryBase:
          type: string
          description: 'e.g.: `gcr.io`, `us.gcr.io`, `eu.gcr.io`, `asia.gcr.io`'
    Getexistingintegrationbytyperesponse:
      title: Getexistingintegrationbytyperesponse
      type: object
      properties:
        id:
          type: string
          description: Alphanumeric UUID including - with a limit of 36 characters
    Getimportjobdetailsresponse:
      title: Getimportjobdetailsresponse
      type: object
      properties:
        id:
          type: string
          description: A uuid representing the job's id
        status:
          type: string
          description: >-
            a string representing the status of a job.


            One of: pending, failed, aborted or complete.
        created:
          type: string
          description: the time when an import job was created represented as a [UTC (ISO-8601)](https://tools.ietf.org/html/rfc3339) string
        logs:
          type: array
          items:
            $ref: '#/components/schemas/logs'
          description: all organizations imported by the job
    Getissuecountsrequest:
      title: Getissuecountsrequest
      required:
        - filters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/Filters12'
      example:
        filters:
          types:
            - unsupported-type
    Getlatestissuecountsrequest:
      title: Getlatestissuecountsrequest
      required:
        - filters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/Filters12'
      example:
        filters:
          types:
            - unsupported-type
    Getlatestprojectcountsrequest:
      title: Getlatestprojectcountsrequest
      required:
        - filters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/Filters16'
      example:
        filters:
          projects:
            - unsupported-project
    Getlistofissuesrequest:
      title: Getlistofissuesrequest
      required:
        - filters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/Filters12'
      example:
        filters:
          types:
            - unsupported-type
    Getlistoflatestissuesrequest:
      title: Getlistoflatestissuesrequest
      required:
        - filters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/Filters12'
      example:
        filters:
          types:
            - unsupported-type
    GetMyDetailsresponse:
      title: GetMyDetailsresponse
      type: object
      properties:
        id:
          type: string
          description: The id of the user.
        username:
          type: string
          description: The username of the user.
        email:
          type: string
          description: The email of the user.
        orgs:
          type: array
          items:
            type: string
          description: The organizations that the user belongs to.

    Getprojectcountsrequest:
      title: Getprojectcountsrequest
      required:
        - filters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/Filters16'
      example:
        filters:
          projects:
            - unsupported-project
    Gettestcountsrequest:
      title: Gettestcountsrequest
      required:
        - filters
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/Filters18'
      example:
        filters:
          isPrivate: non-boolean-value
    GetUserDetailsresponse:
      title: GetUserDetailsresponse
      type: object
      properties:
        id:
          type: string
          description: The id of the user.
        name:
          type: string
          description: The name of the user.
        username:
          type: string
          description: The username of the user.
        email:
          type: string
          description: The email of the user.
    GitHubCrCredentials:
      title: GitHubCrCredentials
      required:
        - username
        - password
        - registryBase
      type: object
      properties:
        username:
          type: string
        password:
          type: string
        registryBase:
          type: string
          description: 'e.g.: `ghcr.io`'
    GitHubCredentials:
      title: GitHubCredentials
      required:
        - token
      type: object
      properties:
        token:
          type: string
    GitHubEnterpriseCredentials:
      title: GitHubEnterpriseCredentials
      required:
        - token
        - url
      type: object
      properties:
        token:
          type: string
        url:
          type: string
    GitLabCrCredentials:
      title: GitLabCrCredentials
      required:
        - username
        - password
        - registryBase
      type: object
      properties:
        username:
          type: string
        password:
          type: string
        registryBase:
          type: string
          description: 'e.g.: `your.gitlab.host`'
    GitLabCredentials:
      title: GitLabCredentials
      required:
        - token
      type: object
      properties:
        token:
          type: string
        url:
          type: string
          description: for self-hosted GitLab only
    GoogleArtifactCrCredentials:
      title: GoogleArtifactCrCredentials
      required:
        - password
        - registryBase
      type: object
      properties:
        password:
          type: string
          description: JSON key file
        registryBase:
          type: string
          description: 'e.g.: `us-east1-docker.pkg.dev`, `europe-west1-docker.pkg.dev`'
    graph2:
      title: graph2
      required:
        - rootNodeId
      type: object
      properties:
        rootNodeId:
          type: string
          description: The internal id of the root node
        nodes:
          type: array
          items:
            $ref: '#/components/schemas/nodes'
          description: A list of the first-level packages
      description: A directional graph of the packages in the project
    Group:
      title: Group
      type: object
      properties:
        name:
          type: string
        id:
          type: string
    Group1:
      title: Group1
      required:
        - name
        - id
      type: object
      properties:
        name:
          type: string
        id:
          type: string
      example:
        name: ACME Inc.
        id: a060a49f-636e-480f-9e14-38e773b2a97f
    groupBy:
      title: groupBy
      enum:
        - issue
      type: string
    groupBy2:
      title: groupBy2
      enum:
        - severity
        - fixable
        - project,[severity|fixable]
      type: string
    groupBy4:
      title: groupBy4
      enum:
        - isPrivate
        - issuesPrevented
      type: string
    HarborCrCredentials:
      title: HarborCrCredentials
      required:
        - username
        - password
        - registryBase
      type: object
      properties:
        username:
          type: string
        password:
          type: string
        registryBase:
          type: string
          description: 'e.g.: `your.harbor.host`'
    identifiers:
      title: identifiers
      type: object
      properties:
        CVE:
          type: array
          items:
            type: string
          description: Common Vulnerability Enumeration identifiers
        CWE:
          type: array
          items:
            type: string
          description: Common Weakness Enumeration identifiers
        OSVDB:
          type: array
          items:
            type: string
          description: Identifiers assigned by the Open Source Vulnerability Database (OSVDB)
      description: External identifiers assigned to the issue (Non-IaC projects only)
    identifiers1:
      title: identifiers1
      type: object
      properties:
        CVE:
          type: array
          items:
            type: string
          description: Common Vulnerability Enumeration identifiers
        CWE:
          type: array
          items:
            type: string
          description: Common Weakness Enumeration identifiers
        OSVDB:
          type: array
          items:
            type: string
          description: Identifiers assigned by the Open Source Vulnerability Database (OSVDB)
      description: External identifiers assigned to the issue (not applicable to licenses)
    Identifiers2:
      title: Identifiers2
      required:
        - CVE
        - CWE
      type: object
      properties:
        CVE:
          type: array
          items:
            type: string
          description: ''
        CWE:
          type: array
          items:
            type: string
          description: ''
      example:
        CVE:
          - CVE-2017-5641
        CWE:
          - CWE-502
    Identifiers4:
      title: Identifiers4
      required:
        - ALTERNATIVE
        - CVE
        - CWE
        - NSP
      type: object
      properties:
        ALTERNATIVE:
          type: array
          items:
            type: string
          description: ''
        CVE:
          type: array
          items:
            type: string
          description: ''
        CWE:
          type: array
          items:
            type: string
          description: ''
        NSP:
          type: array
          items:
            type: integer
            format: int32
          description: ''
      example:
        ALTERNATIVE:
          - SNYK-JS-MS-10064
        CVE:
          - CVE-2015-8315
        CWE:
          - CWE-400
        NSP:
          - 46
    Identifiers5:
      title: Identifiers5
      required:
        - ALTERNATIVE
        - CVE
        - CWE
      type: object
      properties:
        ALTERNATIVE:
          type: array
          items:
            type: string
          description: ''
        CVE:
          type: array
          items:
            type: string
          description: ''
        CWE:
          type: array
          items:
            type: string
          description: ''
        NSP:
          type: array
          items:
            type: integer
            format: int32
          description: ''
      example:
        ALTERNATIVE:
          - SNYK-JS-NODEUUID-10089
        CVE: []
        CWE:
          - CWE-330
        NSP:
          - 93
    Identifiers10:
      title: Identifiers10
      required:
        - CVE
        - CWE
      type: object
      properties:
        CVE:
          type: array
          items:
            type: string
          description: ''
        CWE:
          type: array
          items:
            type: string
          description: ''
        OSVDB:
          type: array
          items:
            type: string
          description: ''
      example:
        CVE: []
        CWE:
          - CWE-400
        OSVDB:
          - OSVDB-101157
    Ignorerules:
      title: Ignorerules
      required:
        - disregardIfFixable
      type: object
      properties:
        ignorePath:
          type: string
          description: The path to ignore (default is `*` which represents all paths).
        reason:
          type: string
          description: The reason that the issue was ignored.
        reasonType:
          allOf:
            - $ref: '#/components/schemas/reasonType'
            - description: The classification of the ignore.
        disregardIfFixable:
          type: boolean
          description: Only ignore the issue if no upgrade or patch is available.
        expires:
          type: string
          description: The timestamp that the issue will no longer be ignored.
    ignored:
      title: ignored
      type: object
      properties:
        reason:
          type: string
          description: A reason why the issue was ignored
        expires:
          type: string
          description: The date when the ignore will no longer apply
        source:
          allOf:
            - $ref: '#/components/schemas/source'
            - description: The place where the ignore rule was applied from
    ignoredBy:
      title: ignoredBy
      required:
        - name
        - email
      type: object
      properties:
        name:
          type: string
          description: The name of the person who ignored the issue.
        email:
          type: string
          description: The email of the person who ignored the issue.
        id:
          type: string
          description: The user ID of the person who ignored the issue.
      description: The person who ignored the issue.
    ignorePath:
      title: ignorePath
      type: object
      properties:
        reason:
          type: string
          description: The reason that the issue was ignored.
        reasonType:
          $ref: '#/components/schemas/reasonType'
        ignoredBy:
          $ref: '#/components/schemas/ignoredBy'
        disregardIfFixable:
          type: boolean
          description: Only ignore the issue if no upgrade or patch is available.
        expires:
          type: string
          description: The timestamp that the issue will no longer be ignored.
        created:
          type: string
          description: The timestamp that the issue was ignored.
      description: The path that should be ignored. Wildcards can be specified with a `*`.
    ignoreReasons:
      title: ignoreReasons
      type: object
      properties:
        reason:
          type: string
          description: A reason why the issue was ignored
        expires:
          type: string
          description: The date when the ignore will no longer apply
        source:
          allOf:
            - $ref: '#/components/schemas/source'
            - description: The place where the ignore rule was applied from
    GithubAndGithubEnterpriseImportRequest:
      title: Github and Github Enterprise Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/GithubAndGithubEnterpriseRepoTarget'
        files:
          type: array
          items:
            $ref: '#/components/schemas/ImportFiles'
          description: an array of file objects
        exclusionGlobs:
          type: string
          description: a comma-separated list of up to 10 folder names to exclude from scanning (each folder name must not exceed 100 characters). If not specified, it will default to "fixtures, tests, \_\_tests\_\_, node_modules". If an empty string is provided - no folders will be excluded. This attribute is only respected with Open Source and Container scan targets.
      example:
        target:
          owner: org-security
          name: goof
          branch: main
        files:
          - path: example/package.json
    AzureReposImportRequest:
      title: Azure Repos Target Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/AzureReposTarget'
        files:
          type: array
          items:
            $ref: '#/components/schemas/ImportFiles'
          description: an array of file objects
        exclusionGlobs:
          type: string
          description: a comma-separated list of up to 10 folder names to exclude from scanning (each folder name must not exceed 100 characters). If not specified, it will default to "fixtures, tests, \_\_tests\_\_, node_modules". If an empty string is provided - no folders will be excluded. This attribute is only respected with Open Source and Container scan targets.
    GitLabImportRequest:
      title: GitLab Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/GitLabRepoTarget'
        files:
          type: array
          items:
            $ref: '#/components/schemas/ImportFiles'
          description: an array of file objects
        exclusionGlobs:
          type: string
          description: a comma-separated list of up to 10 folder names to exclude from scanning. If not specified, it will default to "fixtures, tests, \_\_tests\_\_, node_modules". If an empty string is provided - no folders will be excluded. This attribute is only respected with Open Source and Container scan targets.
    BitbucketCloudImportRequest:
      title: Bitbucket Cloud and Bitbucket Cloud App Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/BitbucketCloudTarget'
        files:
          type: array
          items:
            $ref: '#/components/schemas/ImportFiles'
          description: an array of file objects
        exclusionGlobs:
          type: string
          description: a comma-separated list of up to 10 folder names to exclude from scanning (each folder name must not exceed 100 characters). If not specified, it will default to "fixtures, tests, \_\_tests\_\_, node_modules". If an empty string is provided - no folders will be excluded. This attribute is only respected with Open Source and Container scan targets.
    BitbucketServerImportRequest:
      title: Bitbucket Server Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/BitbucketServerTarget'
        files:
          type: array
          items:
            $ref: '#/components/schemas/ImportFiles'
          description: an array of file objects
        exclusionGlobs:
          type: string
          description: a comma-separated list of up to 10 folder names to exclude from scanning. If not specified, it will default to "fixtures, tests, \_\_tests\_\_, node_modules". If an empty string is provided - no folders will be excluded. This attribute is only respected with Open Source and Container scan targets.
    HerokoImportRequest:
      title: Heroku Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/HerokuTarget'
        files:
          type: array
          items:
            $ref: '#/components/schemas/ImportFiles'
          description: an array of file objects
    AWSLambdaImportRequest:
      title: AWS Lambda Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/AWSLambdaTarget'
        files:
          type: array
          items:
            $ref: '#/components/schemas/ImportFiles'
          description: an array of file objects
    CloudFoundryPivotalIBMCloudImportRequest:
      title: CloudFoundry, Pivotal & IBM Cloud Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/CloudFoundryPivotalIBMCloudTarget'
        files:
          type: array
          items:
            $ref: '#/components/schemas/ImportFiles'
          description: an array of file objects
    DockerHubImportRequest:
      title: DockerHub Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/DockerHubTarget'
    AzureCRElasticCRArtifactoryCRNexusImportRequest:
      title: Azure Container Registry, Elastic Container Registry, Artifactory Container Registry, Nexus Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/AzureContainerRegistryElasticContainerRegistryArifactoryContainerRegistryNexusTarget'
    GoogleCRGoogleARHarborDigitalOceanCRQuayGitlabCRGithubCRImportRequest:
      title: Google Container Registry, Google Artifact Registry, Harbor, DigitalOcean Container Registry, Quay, GitLab Container Registry, GitHub Container Registry Import Request
      type: object
      properties:
        target:
          $ref: '#/components/schemas/GoogleCRGoogleARHarborDigitalOceanCRQuayGitlabCRGithubCR'
    importingUser:
      title: importingUser
      type: object
      properties:
        id:
          type: string
          description: The ID of the user.
          example: e713cf94-bb02-4ea0-89d9-613cce0caed2
        name:
          type: string
          description: The name of the user.
          example: example-user@snyk.io
        username:
          type: string
          description: The username of the user.
          example: exampleUser
        email:
          type: string
          description: The email of the user.
          example: example-user@snyk.io
      description: The user who imported the project
    info:
      title: info
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: The name of the package
        version:
          type: string
          description: The version of the package
    introducedThrough:
      title: introducedThrough
      required:
        - kind
        - data
      type: object
      properties:
        kind:
          type: string
          description: The data kind, each data kind can have different data fields e.g. "ImageLayer"
          example: imageLayer
        data:
          type: object
          description: The information about what introduced the issue. The data structure varies based on the data kind.
    Inviteusersrequest:
      title: Inviteusersrequest
      type: object
      properties:
        email:
          type: string
          description: The email of the user.
        isAdmin:
          type: boolean
          description: (optional) Set the role as admin.
    isPrivate:
      title: isPrivate
      type: object
      properties:
        'true':
          type: number
          description: The number of tests conducted against private projects
        'false':
          type: number
          description: The number of tests conducted against public projects
    issue:
      title: issue
      required:
        - url
        - id
        - title
        - type
        - package
        - version
        - severity
        - originalSeverity
        - exploitMaturity
      type: object
      properties:
        url:
          type: string
          description: URL to a page containing information about the issue
        id:
          type: string
          description: The identifier of the issue
        title:
          type: string
          description: The issue title
        type:
          type: string
          description: The issue type, can be "vuln", "license"
        package:
          type: string
          description: The name of the package that the issue relates to
        version:
          type: string
          description: The version of the package that the issue relates to. If we `groupBy` issue, this will return the most recent version of the package the issue relates to
        severity:
          type: string
          description: The severity status of the issue, after policies are applied
        originalSeverity:
          type: string
          description: The original severity status of the issue, as retrieved from Snyk Vulnerability database, before policies are applied
        uniqueSeveritiesList:
          type: array
          items:
            type: string
          description: A list of all severities in issue per projects
        exploitMaturity:
          type: string
          description: The exploit maturity of the issue
        isUpgradable:
          type: boolean
          description: Whether the issue can be fixed by upgrading to a later version of the dependency
        isPatchable:
          type: boolean
          description: Whether the issue can be patched
        isPinnable:
          type: boolean
          description: Whether the issue can be pinned
        jiraIssueUrl:
          type: string
          description: The link to the Jira issue attached to the vulnerability
        publicationTime:
          type: string
          description: The date that the vulnerability was first published by Snyk (not applicable to licenses)
        disclosureTime:
          type: string
          description: The date that the vulnerability was first disclosed (not applicable to licenses)
        language:
          type: string
          description: The language of the issue
        packageManager:
          type: string
          description: The package manager of the issue
        identifiers:
          allOf:
            - $ref: '#/components/schemas/identifiers1'
            - description: External identifiers assigned to the issue (not applicable to licenses)
        credit:
          type: array
          items:
            type: string
          description: The list of people responsible for first uncovering or reporting the issue (not applicable to licenses)
        CVSSv3:
          type: string
          description: The CVSS v3 string that signifies how the CVSS score was calculated (not applicable to licenses)
        priorityScore:
          type: number
          description: The priority score ranging between 0-1000
        cvssScore:
          type: number
          description: The CVSS score that results from running the CVSSv3 string (not applicable to licenses)
        patches:
          type: array
          items:
            $ref: '#/components/schemas/patches'
          description: A list of patches available for the given issue (not applicable to licenses)
        isIgnored:
          type: boolean
          description: Whether the issue has been ignored (only present if there is no `groupBy` in the API request)
        isPatched:
          type: boolean
          description: Whether the issue has been patched (not applicable to licenses and only present if there is no `groupBy` in the API request)
        semver:
          allOf:
            - $ref: '#/components/schemas/semver1'
            - description: The ranges that are vulnerable and unaffected by the issue
        ignored:
          type: array
          items:
            $ref: '#/components/schemas/ignored'
          description: The list of ignore rules that were applied to the issue (only present if issue was ignored and no `groupBy` in the API request)
    issueCounts2:
      title: issueCounts2
      type: object
      properties:
        vuln:
          $ref: '#/components/schemas/vuln'
        license:
          $ref: '#/components/schemas/license'
        sast:
          $ref: '#/components/schemas/sast'
      description: Number of known vulnerabilities in the project, not including ignored issues
    issueCountsBySeverity:
      title: issueCountsBySeverity
      type: object
      properties:
        low:
          type: number
          description: Number of low severity vulnerabilities
          example: 13
        medium:
          type: number
          description: Number of medium severity vulnerabilities
          example: 8
        high:
          type: number
          description: Number of high severity vulnerabilities
          example: 1
        critical:
          type: number
          description: Number of critical severity vulnerabilities
          example: 3
      description: Number of known vulnerabilities in the project, not including ignored issues
    issueData:
      title: issueData
      required:
        - id
        - title
        - severity
        - originalSeverity
        - url
        - exploitMaturity
        - path
        - violatedPolicyPublicId
      type: object
      properties:
        id:
          type: string
          description: The identifier of the issue
          example: npm:ms:20170412
        title:
          type: string
          description: The issue title
          example: Regular Expression Denial of Service (ReDoS)
        severity:
          type: string
          description: The severity status of the issue, after policies are applied
          example: low
        originalSeverity:
          type: string
          description: The original severity status of the issue, as retrieved from Snyk Vulnerability database, before policies are applied
          example: high
        url:
          type: string
          description: URL to a page containing information about the issue
          example: https://snyk.io/vuln/npm:ms:20170412
        description:
          type: string
          example: '`## Overview\r\n[`ms`](https://www.npmjs.com/package/ms) is a tiny millisecond conversion utility.\r\n\r\nAffected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to an incomplete fix for previously reported vulnerability [npm:ms:20151024](https://snyk.io/vuln/npm:ms:20151024). The fix limited the length of accepted input string to 10,000 characters, and turned to be insufficient making it possible to block the event loop for 0.3 seconds (on a typical laptop) with a specially crafted string passed to `ms'
        identifiers:
          allOf:
            - $ref: '#/components/schemas/identifiers'
            - description: External identifiers assigned to the issue (Non-IaC projects only)
        credit:
          type: array
          items:
            type: string
          description: The list of people responsible for first uncovering or reporting the issue (Non-IaC projects only)
        exploitMaturity:
          type: string
          description: The exploit maturity of the issue
          example: no-known-exploit
        semver:
          allOf:
            - $ref: '#/components/schemas/semver'
            - description: The ranges that are vulnerable and unaffected by the issue (Non-IaC projects only)
        publicationTime:
          type: string
          description: The date that the vulnerability was first published by Snyk (Non-IaC projects only)
          example: 2017-05-15T06:02:45Z
        disclosureTime:
          type: string
          description: The date that the vulnerability was first disclosed
          example: 2017-04-11T21:00:00Z
        CVSSv3:
          type: string
          description: The CVSS v3 string that signifies how the CVSS score was calculated (Non-IaC projects only)
          example: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
        cvssScore:
          type: number
          description: The CVSS score that results from running the vector from `severities` with the highest CVSS version available.
          example: 3.7
        severities:
          type: array
          items:
            $ref: '#/components/schemas/severityData'
          description: The list of cvssSources renamed to severities for issueData model
          example:
            - assigner: NVD
              severity: medium
              baseScore: 4.8
              vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L/E:A
              cvssVersion: '4.0'
              modificationTime: 2024-03-07T07:47:26.644482Z
        exploitDetails:
          type: object
          properties:
            target:
              $ref: '#/components/schemas/exploitDetail'
          description: The exploit maturity of the vulnerability in different industry-standard formats, as well as the sources of the information.
          example:
            sources:
              - CISA
            maturityLevels:
              - format: CVSS_v3
                level: no-known-exploit
        language:
          type: string
          description: The language of the issue (Non-IaC projects only)
          example: js
        patches:
          type: array
          items:
            $ref: '#/components/schemas/patches'
          description: A list of patches available for the given issue (Non-IaC projects only)
        nearestFixedInVersion:
          type: string
          description: Nearest version which includes a fix for the issue. This is populated for container projects only. (Non-IaC projects only)
          example: 2.0.0
        path:
          type: string
          description: Path to the resource property violating the policy within the scanned project. (IaC projects only)
          example: '[DocId: 1].input.spec.template.spec.containers[snyk2].securityContext.privileged'
        violatedPolicyPublicId:
          type: string
          description: The ID of the violated policy in the issue (IaC projects only)
          example: SNYK-CC-K8S-1
        isMaliciousPackage:
          type: boolean
          description: Whether the issue is intentional, indicating a malicious package
          example: true
      description: The details of the issue
    severityData:
      type: object
      properties:
        assigner:
          type: string
          description: The entity that assigned this CVSS vector
        severity:
          type: string
          description: The severity calculated via vector
        baseScore:
          type: number
          description: The CVSS score that results from running the CVSS string (Non-IaC projects only)
        vector:
          type: string
          description: The CVSS string that signifies how the CVSS score was calculated (Non-IaC projects only)
        cvssVersion:
          type: string
          description: The CVSS version that is being described
        modificationTime:
          type: string
          description: The date severities was last modified
    exploitDetail:
      type: object
      properties:
        sources:
          type: array
          items:
            type: string
          description: The sources by which we determined the exploit maturity level
        maturityLevels:
          type: array
          items:
            $ref: '#/components/schemas/maturityLevel'
    maturityLevel:
      type: object
      properties:
        format:
          type: string
          description: The standard by which the “maturity” value is shown
        level:
          type: string
          description: The exploit maturity of the issue
    Issues1:
      title: Issues1
      required:
        - vulnerabilities
        - licenses
      type: object
      properties:
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability1'
          description: ''
        licenses:
          type: array
          items:
            type: string
          description: ''
      example:
        vulnerabilities:
          - id: SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
            url: https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
            title: Arbitrary Code Execution
            type: vuln
            description: >
              ## Overview


              [org.apache.flex.blazeds:blazeds](https://github.com/apache/flex-blazeds) is an application development framework for easily building Flash-based applications for mobile devices, web browsers, and desktops.



              Affected versions of this package are vulnerable to Arbitrary Code Execution.

              The AMF deserialization implementation of Flex BlazeDS is vulnerable to Deserialization of Untrusted Data. By sending a specially crafted AMF message, it is possible to make the server establish a connection to an endpoint specified in the message and request an RMI remote object from that endpoint. This can result in the execution of arbitrary code on the server via Java deserialization.



              Starting with BlazeDS version `4.7.3`, Deserialization of XML is disabled completely per default, while the `ClassDeserializationValidator` allows deserialization of whitelisted classes only. BlazeDS internally comes with the following whitelist:

              ```

              flex.messaging.io.amf.ASObject

              flex.messaging.io.amf.SerializedObject

              flex.messaging.io.ArrayCollection

              flex.messaging.io.ArrayList

              flex.messaging.messages.AcknowledgeMessage

              flex.messaging.messages.AcknowledgeMessageExt

              flex.messaging.messages.AsyncMessage

              flex.messaging.messages.AsyncMessageExt

              flex.messaging.messages.CommandMessage

              flex.messaging.messages.CommandMessageExt

              flex.messaging.messages.ErrorMessage

              flex.messaging.messages.HTTPMessage

              flex.messaging.messages.RemotingMessage

              flex.messaging.messages.SOAPMessage

              java.lang.Boolean

              java.lang.Byte

              java.lang.Character

              java.lang.Double

              java.lang.Float

              java.lang.Integer

              java.lang.Long

              java.lang.Object

              java.lang.Short

              java.lang.String

              java.util.ArrayList

              java.util.Date

              java.util.HashMap

              org.w3c.dom.Document

              ```


              ## Remediation


              Upgrade `org.apache.flex.blazeds:blazeds` to version 4.7.3 or higher.



              ## References


              - [CVE-2017-3066](https://nvd.nist.gov/vuln/detail/CVE-2017-5641)


              - [Github Commit](https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1)


              - [Github Release Notes](https://github.com/apache/flex-blazeds/blob/master/RELEASE_NOTES)


              - [Securitytracker Issue](http://www.securitytracker.com/id/1038364)
            functions: []
            from:
              - org.apache.flex.blazeds:blazeds@4.7.2
            package: org.apache.flex.blazeds:blazeds
            version: 4.7.2
            severity: critical
            exploitMaturity: no-known-exploit
            language: java
            packageManager: maven
            semver:
              vulnerable:
                - '[,4.7.3)'
            publicationTime: 2017-08-09T14:17:08Z
            disclosureTime: 2017-04-25T21:00:00Z
            isUpgradable: true
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE:
                - CVE-2017-5641
              CWE:
                - CWE-502
            credit:
              - Markus Wulftange
            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
            cvssScore: 9.8
            patches: []
            upgradePath:
              - org.apache.flex.blazeds:blazeds@4.7.3
        licenses: []
    aggregatedProjectIssue:
      title: aggregatedProjectIssue
      required:
        - id
        - issueType
        - pkgName
        - pkgVersions
        - issueData
        - isPatched
        - isIgnored
      type: object
      properties:
        id:
          type: string
          description: The identifier of the issue
          example: npm:ms:20170412
        issueType:
          type: string
          description: type of the issue ('vuln', 'license' or 'configuration')
          example: vuln
        pkgName:
          type: string
          description: The package name (Non-IaC projects only)
          example: ms
        pkgVersions:
          type: array
          items:
            type: string
          description: List of affected package versions (Non-IaC projects only)
        issueData:
          allOf:
            - $ref: '#/components/schemas/issueData'
            - description: The details of the issue
        introducedThrough:
          type: array
          items:
            $ref: '#/components/schemas/introducedThrough'
          description: The list of what introduced the issue (it is available only for container project with Dockerfile)
        isPatched:
          type: boolean
          description: Whether the issue has been patched (Non-IaC projects only)
        isIgnored:
          type: boolean
          description: Whether the issue has been ignored
        ignoreReasons:
          type: array
          items:
            $ref: '#/components/schemas/ignoreReasons'
          description: The list of reasons why the issue was ignored
        fixInfo:
          allOf:
            - $ref: '#/components/schemas/fixInfo'
            - description: Information about fix/upgrade/pinnable options for the issue (Non-IaC projects only)
        priority:
          allOf:
            - $ref: '#/components/schemas/priority'
            - description: Information about the priority of the issue (Non-IaC projects only)
        links:
          allOf:
            - $ref: '#/components/schemas/links'
            - description: Onward links from this record (Non-IaC projects only)
    Issues3:
      title: Issues3
      required:
        - vulnerabilities
        - licenses
      type: object
      properties:
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability2'
          description: ''
        licenses:
          type: array
          items:
            type: string
          description: ''
    Issues4:
      title: Issues4
      required:
        - vulnerabilities
        - licenses
      type: object
      properties:
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability3'
          description: ''
        licenses:
          type: array
          items:
            type: string
          description: ''
      example:
        vulnerabilities:
          - id: npm:ms:20151024
            url: https://snyk.io/vuln/npm:ms:20151024
            title: Regular Expression Denial of Service (ReDoS)
            type: vuln
            description: >
              ## Overview


              [ms](https://www.npmjs.com/package/ms) is a tiny millisecond conversion utility.



              Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS)

              attack when converting a time period string (i.e. `"2 days"`, `"1h"`) into a milliseconds integer. A malicious user could pass extremely long strings to `ms()`, causing the server to take a long time to process, subsequently blocking the event loop for that extended period.


              ## Details

              Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.



              The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.



              Let’s take the following regular expression as an example:

              ```js

              regex = /A(B|C+)+D/

              ```



              This regular expression accomplishes the following:

              - `A` The string must start with the letter 'A'

              - `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.

              - `D` Finally, we ensure this section of the string ends with a 'D'



              The expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`



              It most cases, it doesn't take very long for a regex engine to find a match:



              ```bash

              $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'

              0.04s user 0.01s system 95% cpu 0.052 total



              $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'

              1.79s user 0.02s system 99% cpu 1.812 total

              ```



              The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.



              Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.



              Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

              1. CCC

              2. CC+C

              3. C+CC

              4. C+C+C.



              The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.



              From there, the number of steps the engine must use to validate a string just continues to grow.



              | String | Number of C's | Number of steps |

              | -------|-------------:| -----:|

              | ACCCX | 3 | 38

              | ACCCCX | 4 | 71

              | ACCCCCX | 5 | 136

              | ACCCCCCCCCCCCCCX | 14 | 65,553





              By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.


              ## Remediation


              Upgrade `ms` to version 0.7.1 or higher.



              ## References


              - [OSS Security advisory](https://www.openwall.com/lists/oss-security/2016/04/20/11)


              - [OWASP - ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)


              - [Security Focus](https://www.securityfocus.com/bid/96389)
            functions:
              - functionId:
                  filePath: ms.js
                  functionName: parse
                version:
                  - '>0.1.0 <=0.3.0'
              - functionId:
                  filePath: index.js
                  functionName: parse
                version:
                  - '>0.3.0 <0.7.1'
            from:
              - ms@0.7.0
            package: ms
            version: 0.7.0
            severity: medium
            exploitMaturity: no-known-exploit
            language: js
            packageManager: npm
            semver:
              vulnerable:
                - <0.7.1
            publicationTime: 2015-11-06T02:09:36Z
            disclosureTime: 2015-10-24T20:39:59Z
            isUpgradable: true
            isPatchable: true
            isPinnable: false
            identifiers:
              ALTERNATIVE:
                - SNYK-JS-MS-10064
              CVE:
                - CVE-2015-8315
              CWE:
                - CWE-400
              NSP:
                - 46
            credit:
              - Adam Baldwin
            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
            cvssScore: 5.3
            patches:
              - comments: []
                id: patch:npm:ms:20151024:5
                modificationTime: 2019-12-03T11:40:45.777474Z
                urls:
                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_5_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk5.patch
                version: =0.1.0
              - comments: []
                id: patch:npm:ms:20151024:4
                modificationTime: 2019-12-03T11:40:45.776329Z
                urls:
                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_4_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk4.patch
                version: =0.2.0
              - comments: []
                id: patch:npm:ms:20151024:3
                modificationTime: 2019-12-03T11:40:45.775292Z
                urls:
                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_3_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk3.patch
                version: =0.3.0
              - comments: []
                id: patch:npm:ms:20151024:2
                modificationTime: 2019-12-03T11:40:45.774221Z
                urls:
                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_2_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk2.patch
                version: <0.6.0 >0.3.0
              - comments: []
                id: patch:npm:ms:20151024:1
                modificationTime: 2019-12-03T11:40:45.773094Z
                urls:
                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_1_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk.patch
                version: <0.7.0 >=0.6.0
              - comments: []
                id: patch:npm:ms:20151024:0
                modificationTime: 2019-12-03T11:40:45.772009Z
                urls:
                  - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_0_0_48701f029417faf65e6f5e0b61a3cebe5436b07b.patch
                version: =0.7.0
            upgradePath:
              - ms@0.7.1
        licenses: []
    Issues5:
      title: Issues5
      required:
        - vulnerabilities
        - licenses
      type: object
      properties:
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability4'
          description: ''
        licenses:
          type: array
          items:
            type: string
          description: ''
    Issues6:
      title: Issues6
      required:
        - vulnerabilities
        - licenses
      type: object
      properties:
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability5'
          description: ''
        licenses:
          type: array
          items:
            $ref: '#/components/schemas/Licenses1'
          description: ''
      example:
        vulnerabilities:
          - id: SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
            url: http://localhost:34612/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
            title: Insecure Randomness
            type: vuln
            description: "## Overview\n[github.com/satori/go.uuid](https://github.com/satori/go.uuid) provides pure Go implementation of Universally Unique Identifier (UUID).\r\n\r\nAffected versions of this package are vulnerable to Insecure Randomness producing predictable `UUID` identifiers due to the limited number of bytes read when using the `g.rand.Read` function.\r\n \r\n## Disclosure Timeline\r\n* Jun 3th, 2018 - The vulnerability introduced by replacing the function `rand.Read()` with the function `g.rand.Read()` (https://github.com/satori/go.uuid/commit/0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c)\r\n* Mar 23th, 2018- An issue was reported.\r\n* Oct 16th, 2018 Issue fixed\r\n\r\n## Remediation\r\nA fix was merged into the master branch but not yet published.\n\n## References\n- [GitHub Commit](https://github.com/satori/go.uuid/commit/d91630c8510268e75203009fe7daf2b8e1d60c45)\n- [Github Issue](https://github.com/satori/go.uuid/issues/73)\n"
            functions: []
            from:
              - github.com/satori/go.uuid@v1.2.0
            package: github.com/satori/go.uuid
            version: v1.2.0
            severity: high
            exploitMaturity: no-known-exploit
            language: golang
            packageManager: golang
            semver:
              hashesRange:
                - '>=0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c <d91630c8510268e75203009fe7daf2b8e1d60c45'
              vulnerable:
                - =1.2.0
              vulnerableHashes:
                - c596ec57260fd2ad47b2ae6809d6890a2f99c3b2
                - 36e9d2ebbde5e3f13ab2e25625fd453271d6522e
                - f6920249aa08fc2a2c2e8274ea9648d0bb1e9364
                - 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c
            publicationTime: 2018-10-24T08:56:41Z
            disclosureTime: 2018-03-23T08:57:24Z
            isUpgradable: false
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE: []
              CWE:
                - CWE-338
            credit:
              - josselin-c
            CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
            cvssScore: 8.1
            patches: []
            upgradePath: []
        licenses:
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl/json/token@v1.0.0
            package: github.com/hashicorp/hcl/json/token
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl/json/scanner@v1.0.0
            package: github.com/hashicorp/hcl/json/scanner
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl/json/parser@v1.0.0
            package: github.com/hashicorp/hcl/json/parser
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl/hcl/token@v1.0.0
            package: github.com/hashicorp/hcl/hcl/token
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl/hcl/strconv@v1.0.0
            package: github.com/hashicorp/hcl/hcl/strconv
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl/hcl/scanner@v1.0.0
            package: github.com/hashicorp/hcl/hcl/scanner
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl/hcl/printer@v1.0.0
            package: github.com/hashicorp/hcl/hcl/printer
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl/hcl/parser@v1.0.0
            package: github.com/hashicorp/hcl/hcl/parser
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl/hcl/ast@v1.0.0
            package: github.com/hashicorp/hcl/hcl/ast
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
          - id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
            title: MPL-2.0 license
            type: license
            from:
              - github.com/hashicorp/hcl@v1.0.0
            package: github.com/hashicorp/hcl
            version: v1.0.0
            severity: medium
            language: golang
            packageManager: golang
            semver:
              vulnerable:
                - '>=0'
              vulnerableHashes:
                - '*'
    Issues7:
      title: Issues7
      required:
        - vulnerabilities
        - licenses
      type: object
      properties:
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability5'
          description: ''
        licenses:
          type: array
          items:
            type: string
          description: ''
      example:
        vulnerabilities:
          - id: SNYK-GOLANG-GITHUBCOMDOCKERLIBCONTAINER-50012
            url: https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMDOCKERLIBCONTAINER-50012
            title: Symlink Attack
            type: vuln
            description: >
              ## Overview

              Affected version of [`github.com/docker/libcontainer`](https://github.com/docker/libcontainer) are vulnerable to Symlink Attacks.

              Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.


              ## References

              - [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3627)

              - [GitHub Commit](https://github.com/docker/libcontainer/commit/46132cebcf391b56842f5cf9b247d508c59bc625)

              - [Packetstorm Security](http://packetstormsecurity.com/files/131835/Docker-Privilege-Escalation-Information-Disclosure.html)

              - [Seclists](http://seclists.org/fulldisclosure/2015/May/28)

              - [Docker Security Advisory](https://groups.google.com/forum/#%21searchin/docker-user/1.6.1/docker-user/47GZrihtr-4/nwgeOOFLexIJ)
            functions: []
            from:
              - github.com/docker/libcontainer@v1.4.0
            package: github.com/docker/libcontainer
            version: v1.4.0
            severity: critical
            exploitMaturity: no-known-exploit
            language: golang
            packageManager: golang
            semver:
              hashesRange:
                - '>=5c246d038fc47b8d57a474e1b212ffe646764ee9 <46132cebcf391b56842f5cf9b247d508c59bc625'
              vulnerable:
                - <1.6.1
              vulnerableHashes:
                - cab4b9bce1bece1b6c575e1826f3e5b221faebf3
                - 4a72e540feb67091156b907c4700e580a99f5a9d
                - eb74393a3d2daeafbef4f5f27c0821cbdd67559c
                - 4332ffcfc6765245e8e9151a2907b0e4b76f218f
                - 7eceabd47f41328d6e894418ae167ce8377bda22
                - ecace12e5a3e309d82c5b3b1548a3251b3bc4e2a
                - afb167a417ed8379c008b070fb5c0b1bc84bbcba
                - 2b4512809110033e5ec532167efd6fabf2dd596d
                - c2403c32dbf8a67870ab2ba7524c117fc0652256
                - 4077c254a6ac99930d720a9b95709dbd2614bc61
                - 1b755bf962ec1d29e9e5e66e2cc15704fac088e7
                - 1c9de5b4d21b94499a1e91c9b94ba06831ac5393
                - e3184f97e040c3121502dc382d41ac58a98b685a
                - 0dee9793d5efd9842a2e8890fa0f8981d20b196e
                - 3e9299d6da5749b263fc3dc93d50b5c854fa199c
                - 152107f44ae9e38b38609fdbc75ac6f9f56c4fed
                - 623fe598e4d5e75e70440f45298eecec414788b3
                - e30793aed7a30772054abfb1b3f3f703f119b55b
                - 0596e6384a586223c56c5ea7d14467ebf5d17247
                - 42fed751fbab3f340461d06edb896cd10cd49812
                - e451df796aaa605413a0b84ddd1bf39ec4a751a0
                - b0eece8d7d945e1e7fc98c2ae3b7dd0a860a7c2a
                - 5c246d038fc47b8d57a474e1b212ffe646764ee9
                - bfa67ab988f434fd6836c1868eb5d7d1d7864e8a
                - 9bebc660423ca974192599a6a5ea8e016a6fe1fc
                - e22b58954324b3593737438032412f15ed9602e9
                - af371eae767ceb51b8804f212bf97584d876feb3
                - f61899ece3fc1da206a0eb28fada0595ab381887
                - 0d0402712b5a13d1b54a345a63ec67982e2e0089
                - d1ae7cd67310f482af22de3abeb26d28e65274bf
                - 9f2c67332f48c0050846ac86e01cb5dadbd1d8fe
                - 62bdfc482d8edaa618b544fb2beafdf0c44dce5e
                - 699429e60f23ab0fa3bdd97b6326316be08791ad
                - 35c01f9eb3c228201a3fc5d2301d1fc7a00bde13
                - a72f710d89eaabf23dad7c084082bccb26e6336f
                - eb84dd1b73df035e6e64c8513daaa476c72dedfc
                - 5b73860e65598203b26d57aabc96ae0f52c9f9ab
                - d64cfe5c05448935c75c92f65d604c751bbf5153
                - 62626677876330d60fe3512f59f1fd8f82799ca5
                - 43842efeccbd8077dba8f85fc9e772e0647b82cb
                - d6cd7ce43faa53d212052dbbcf209029ec2ec951
                - ebefcddc3c4b99ae312ac575c288856e177ed6ef
                - 83add60f217d32561ff0ff62ebf1d6db6a2a11a3
                - 14af6755f04233fbe55cb354a9351fe05afd43a0
                - 8530167f7f5b5eb329f5377b6b74a904482a10ed
                - 000d36e109f5d04bad5342bb779e02b2b9b252f7
                - 1db687f4f480c06e6cadfdb0971985df4313ddc7
                - 689e8ec9493a4294856dc1568f5ef667e106707c
                - 0eb8a1aac3d903b3c7925208c34f09c02910e7aa
                - edb31ce0a6fd7956bffc0829000c60bdd56b9f32
                - 53fce307557cbffdbc54647ef63956b2cb0cee86
                - c22d5c90cf907f4f34d2bc13cad9c82a7fce9077
                - ef1c1c4289559e818d3ec77ce9c1b6a77d2ac764
                - 2da44f8c7b703f87e9c07164c9cc1cdd31031783
                - ee102305fb35a23668136b102ed4d0dd5b3d9ce5
                - 3ca0e1ff95c54577c65b5fbb734c267c23782974
                - f115a5f6c8c2a3cc6340408e6644236a88dcaad0
                - 29ba9b3179d014cc87129af5c51b1263443f387b
                - c1ca18404fa63209e0a65abf443669155991b4df
                - 5bb81469895d669ddcb4b49e83809a980d57d6b1
                - 6feb7bda04b3130e81cf9606ddb7a156d4a63f7a
                - 7c8550af53b4d428d8f3a7c19c0c4a8ebca8ff21
                - 7766c1e07bd49fdc290f0557268950d35b867823
                - 4903df2ed52a01f08626739ad35937752de82a09
                - 58feafa848d9657dda34e5ccc3a196e359566bda
                - 9e787db1b108941edab18209a7468e6c555002ce
                - e7953c3609b62a25b0bfedcd9d3885ca1b99d2fb
                - 8c3b6b18689796bc9625258258e8664746b24e85
                - dd3cb8822352fd4acc0b8b426bd86e47e98f6853
                - cc524f1b729cb5d7592d0a0b07cb3ff1fe6eda98
                - c22ac4876f0a218584ae862900f3058470be38a3
                - c1fb904d1047359e8c4dadafaa0ab065efe9e03e
                - 1f176f3c0dae283d66df5360de8a93ec14b4fbd0
                - 50f0faa795dc62773857a0cc3cfb6d5681ba3562
                - 3fbf1856025f54b6eab6e73b7ff8aa4d1020e1c1
                - f4a4391e4ef7e886e56816ae59cbe99d8cff91d9
                - 2d9ef3af72e89ad9df164bd0f435371aa4fa0dea
                - 187792e35bb47c89fdfe34409162c814627daacc
                - b322073f27b0e9e60b2ab07eff7f4e96a24cb3f9
                - f78bf211f023d28392c6aa0d1934bb1001b3a180
                - 20af7e70e2511b4da0e035bf2fa2d6295f198970
                - f8eb40433c4a8617a20ad36119973af6f9dd2cd0
                - d7dea0e925315bab640115053204c16718839b1e
                - 295c70865d10d7c57ba13cbef45c1d276ebfa83e
                - 5a87153824b838be92503b57e76e96519b84b522
                - fec4c5ab0a75d7e6a46955bda0818bed7f8fecf3
                - 6a76ecb1ce53d9e623826b238033b86f072395a9
                - 2c037b7fd98e1c03e0c67ceccfd8e3300457e07e
                - 4ce8d973204ebace2970c662f6f841ab11a3cc13
                - 870119e763b5976d7331fbd8656ed65207ba95ad
                - 58fc93160e03387a4f41dcf4aed2e376c4a92db4
                - a3b0209cc61301941810e54bc3678ccff9af71c1
                - ec005e73b9169d17651618b91836a5d86eb7b24c
                - 2fac2dad91e390acb8937ede6154c265b7011cf9
                - 0195469398f4fc1d42c0c20172b51e03ccf9ff1a
                - 8d0b06257ba659ee91fa3862ed358cecbee37f73
                - 6516e6ce8c7c71e44f95332ef740ea4082cfee39
                - 55d61e22c5e0e4dc00c99847ba20a8ffa1e3a3d4
                - ca73d7aede7eaa05f4a0acb4bd5cb17a9408cd27
                - 43fabe36d18fa36326d9e5efd2cca8b9376a7fdf
                - c06f92353f4f74cdb1c66ee0bbae1cdbb46934ce
                - d6fae7bb26807a386f5dd9a1ec2dc5ac51c24498
                - bde8bf2ebc5630399c7d0965f58b502100180400
                - 444cc2989aca50986b45a56bfd8a32bd7ea23c1c
                - f5dfd9a702ad163be35023fe08c9573a614d6121
                - 6c2f20eeeca488b98a613e013712d7c9a3d1e619
                - cc42996625afaf38d281f2457b08551a3df0d7bc
                - 903680701ad5cf25484d0ac3e78152807dfa90b3
                - 69228248334a576549a9af9df389b3cbfe0c211c
                - 6460fd79667466d2d9ec03f77f319a241c58d40b
                - 7d9244eab20fc96230636a066f88ad5165c34bc7
                - 9387ebb6ba5fca526aedb54c7df684102639caa3
                - b21b19e0607582cceb8d715b85d27ec113a0b799
                - c4821b6f3e0a41af6bf3ed1cfa168c13381b9554
                - 397b675315d00a34a09f058dd7e462af6f715da3
                - c504f85aabbff0d7380ca9da3f6051c56905c7c0
                - 0f8f0601ae5668510ab7bde03041dafd39b18ec6
                - c3ab8d0cb4b439b7691edf7b63fcecd169834250
                - 22df5551ed7367eb9cbb0cc22aea46351d2495ad
                - d284fdfaa36d37cbba5749562d6f9303ebab7d2f
                - a9a503082e492575be352c9c82040c1f4ed468d1
                - 5fedffd8fd387b24b25186622c9566325ab3db1b
                - dc827aa0ee51829d292524fdf3a7a163feadabe2
                - f925aa3503eeba9d372c74d1fe2b17c8ecd97960
                - bc1d229dbe94a0100f4530b47e9c918f27b8cecd
                - 71a57166c1209103dcd4355d21c161bd0f09e481
                - a9644c209f7764f9155db0c4aeb4f690c0cdb585
                - bcfdee970e8a32d04b472cd2c5712e10a5e425fe
                - 3c474b9e2aad7c577faefca6c35a8512140c0c65
                - c34b3d5ce90a6b2828d5b97f553f4b49f64081af
                - 286fffa4eeda7745f3b36dc938dae3e155d1b204
                - d1f0d5705debbe4d4b1aed7e087d5c49300eb271
                - 08fdb50b03dc810ca8c4386f4f8271a8d51d4445
                - c44ab12c86689065978950d2ed92bb131b2a932c
                - 5df859ad240af502aebef01ca28da3ef24951e05
                - ef4efd065cb6c136c7fcbdd65285cff549b745ac
                - 2f1b2ce204490854938fab57142b557caa4ab66d
                - a36d471a0ef4e119ecfb41257aad246464024a40
                - 83663f82e3d76f57ea57faf80b8fd7eb96933b9b
                - e8f5b543010eb0db146fd2593284ed19af93eccd
                - c8512754166539461fd860451ff1a0af7491c197
                - dc4c502efd85727abfed95af7789caa7f10d020d
                - 4940cee052ece5a8b2ea477699e7bb232de1e1f8
                - 025e6be6c5dc3d535286461088416afa74c42927
                - b4cda7a6cabf1966daf67f291c2c41ff9a1369f4
                - 074441b495052c456f4b96524bd7a80d00db42e8
                - 5847aacb32742fd734fa2c0584cae65636bba370
                - f9590b0927744d22ad0e1b737eecd07a48bb4c2f
                - e05f807a8936b4491632290f13958ca26d0aaace
                - fd0087d3acdc4c5865de1829d4accee5e3ebb658
                - 38f729e577e07b2c3333ed4b04146e1d64f665a8
                - 8a8eb57746e5372080a5f5e5b6fb9dce178c8220
                - afa8443118347a1f909941aec2732039d28a9034
                - d6eb76f8a2184688489fc3a611d80de36ef50877
                - 0f397d4e145fb4053792d42b3424dd2143fb23ad
                - ba613c5a847ff30d312726eeff444714f8e31cde
                - 445bebc1b16b1f2646a3cae841fe0e1266d79ada
                - e2ed997ae5b675fc8e78e7d0f9e6918c8b87503c
                - 3b95acdfa1e54de15cae2fc3083147a185a31792
                - cacc15360ec04abb4c45f918e83bf33203946e32
                - 09809b551ce9f05e96fc3055ae7a23329604415b
                - 2a9511a0266afd48251609a03533094afe22fce2
                - b6cf7a6c8520fd21e75f8b3becec6dc355d844b0
                - fc3981ea5c10fb21cae6d6a8e78755be5b169999
                - dc34fe188385f42198997f6aedc170487c57c7eb
                - e9f8f8528abef64b8e1b8bc046a008b009ab2417
                - fe9f7668957641a404b0d2c8850f104df591e7f2
                - 8da9c6878fa29f33dcfd74b1146d457a576d738a
                - 4622c8ac9541790365eda22b6ce65d038f4026fe
                - 3977c892e78d91a0c6d2a34fd2512a6c53c8d924
                - 1bd146ed82f771395f991851f7d896d9ae778f3c
                - 77085907a44039fe1cf9fe24d9c7675aa53d2f9b
                - 107bad0ee5141bb847257a6f57dff2469dd584da
                - 2da159823d0a54756308e73dc0e58a420daffad4
                - 94fb37f5573e1484ba686b195079684cace18eb0
                - 5c6332687d5d7c902cdd954e4e6a107ed6c60848
                - 8b77eba9a6b506c71d1542d2fab1495249a7f7b6
                - da32455210de558c829f089e8c3a3d1ed8c34a5b
                - e1c14b3ca245fd06ef538005cd3a250904be5b4c
                - f0d1a8fc27830b899c5789ba2f80dfa9458792a4
                - 846e522ffc157c12ba244c2c8a2c6adb1ed789f7
                - 2a452c17aa2417cd89b5e25e8549f9e09c94a0dc
                - 3cd416efe1e5b7d1679a20a91a73d757d481633b
                - e0de51f53c6b2711f39f4f29eb58b63a9ebf2c5c
                - f7837f4f717a9f09cf34fc325061ee8e38d1100a
                - 13a5703d853fbd311e1fcfc5c95d459021781951
                - 2aebf7d849e47ca927de332b82983ba8fe03d062
                - 56bc1485df0ac0c2fe8ae5e0499e50a0580f2522
                - 8d0f911e1d9265a8f362a7a16b893f7c40aee434
                - dc82e30089dbba31a1d0cf459321486a9b546fa0
                - 4d863b7bd0d7da6ca1108031fd7d7997bf504496
                - 73ba097bf596249068513559225d6e18c1767b47
                - da109f3af037352af24f935b1ea57ba8a7f26cad
                - 3c52181f613353cc3b8aefbbf637c15a11cb8242
                - c96cde4e5db0da7e798e2712c2312f2468720a98
                - 52a8c004ca94cf98f6866536de828c71eb42d1ec
                - b89112c542edcc9cf5af75694c16af28a3e4f12b
                - c099a20eb8bd084c17d9348bd0f6bef066ea514f
                - 8067e34ec01588d2952d57e21c8c637fd3d3d114
                - 9d4f6b3d3d4feba35ea13097be415bf099b670ce
                - 334b1963711b743bf014502c5513a82a23eb65cc
                - 190e50b08dbd72fd1d9f21f20581fa27a498481c
                - 4c43b0f49880840966cb5df13abeeb19aa8e16d7
                - 9946e299af9e911a54c83626f245dff20127e442
                - 9825a26db570697e058a4580ec3b71ab3d82fc24
                - f8daab8a96fe2c73974073696d00deb4ffb40d47
                - 88989e66d3a1ab960deb37f3dd7f824d85e1b9bc
                - c5eef904604b7e22083927bb99ea0c196d4cb8b9
                - 4661c239dc6394aba960ba73144f2a7e3859537f
                - 9303a8f15f6e55931a08542636922c1bf041ad52
                - 9d91f080ced0bbfcbd3c003e2a20c9cdc81bc4ff
                - 99233fde8c4f58853a474a5831ef0bcf6bf866c5
                - 14a7d2f468404e25577dced6982248e80ddce79a
                - b6a1b889852cd6b365833ce2b04a0c1092867f75
                - 5d6c507d7cfeff97172deedf3db13b5295bcacef
                - b89cd0cf5cf5deec2ed6fdc0d8ed4e4f3167aeb4
                - be02944484da197166020d6b3f08a19d7d7d244c
                - c37b9125ecaad0c100b6851baacf97adfa2339d6
                - 045e9ae4a0fa8bff397b3c4f2614a3e609e6dd66
                - 9744d72c740dd8cdfbb8cb4c58fb235355e0a0b4
                - 74005ed4e0cdbc87ce40c6b79edfd599ba2355e9
                - 1d7207079fc6ab5b2cbfedda3fc8993bc4441b02
                - 8961fd20e6e213bf967db90166e24d38da065807
                - dd5576b2b3f5667811f882d1f64a11e13164791a
                - 8600e6f3158bafe927706f0613c1520971d16c32
                - e9c1b0144ae784df9d26f59bfadd8cb2fc3a1d69
                - 6423c8d2613e5130e9c37620773d2173c76f0acd
                - b48acf4613cc5347ca10b6d6edd6e1b94a5378c4
                - 6c285c1d4964662ac64f0b98620d154caf423d79
                - 312f997de638b8c18f92a59596a984bdb1a06a4e
                - 11d14f2621370a527d2401c8bba10d2408819131
                - a6044b701c166fe538fc760f9e2dcea3d737cd2a
                - 91a3f162afc90339b1d8f8d2f22d9c4271eddb84
                - 54301f55934f42598b8f7c88effc4bd588e5f3e7
                - 29f5cb6b391eea625c512df1f2ae7d9efccfbae9
                - 087caf69e8cabd8f1f66f6239079b60172c9fb78
                - 21ed4766b1523373b0463af497ef1c6b3b98c2ca
                - 30b33064169e09e1c5daacb38ed461ed5820d0d2
                - a8a798a7c9b1da5beea8acfec16409d015ad85a7
                - a4f2e1e1878c1ce541aec24e6e2a690855cc8003
                - d06a2dab9f185c8cd2c21c0c97342cbdb7b9f38b
                - 12a63757dbde3b0be25b49bc9e7625059088d319
                - 35ae1c48710ff5a4db20645bc98c719cfb695b9a
                - 85cd86999f70339509692b92cf182ec36697edcf
                - 10d49f830b52ed05d9b41e18c8e1ff4a44a85fb3
                - 3f35b26b8b2dcd856b12b985f9091260d5c5bd71
                - 1a37242fa2af5db30ea72b95f948285efcd63d52
                - b49bd705dcddd496aedb6e797ce8691d276236af
                - eb2ae34c80f6b8ffb1bdfc55287d967c6e18cd81
                - 39fbf0a90423a1e6e31c6c042acd9aea00793a18
                - d658fb8a2566cab11600af4db164c5f1f8656116
                - f4cf808a3d184c556a51cd53d98a2f4ea05acee4
                - bdff595cad6a42ba9675f99505bebecdb28209f0
                - 9377591781a5346ed84517688787c305ed6554c4
                - 19099e065da7c810f93e83d68c0776c2336e5e03
                - a1ac9b101571477a81e1cb3c6999f818bbbf0738
                - 54968f68bc2ba50f59a66fba9f6823215a0bc4f6
                - 9455a8ce3aaccceb4c282ef6c84d7edb36dd0d4c
                - 21c344a479a8fd359a9c875f3056a7e72fe4d5fb
                - 00abcf89d9ad026ddce4af0038db7953b01d8b8b
                - 1a246dd54326124df57cb0e8e051f57abb549c9f
                - 07db66a6ef857edee2c731d1b66f42a4f32d9622
                - d4867a6583c17001a60590684d91237a580e786a
                - 46573774a27c7a4d20d508f1f07ba72d34616bc3
                - 9184d9473d7b5ecb0dddca4052171534523602be
                - f6593810da73cf8e1cc982d9020850260fc1ff52
                - a9442e6660e71fd2058310e6155de3ef5e4f5fdf
                - cee97cb0ccad90c369b10d6a9512d678a0535cac
                - aaca2848a1e1eefa71ce2987b19abae2d34cf3aa
                - 3125b53b1aef485ed2239d514b131ef80ad577c1
                - 2990f254f030e62ab15b9399e26368aa3e291d15
                - b19b8a9677ae9e657e0195ac85a4849a67729cf6
                - e3b14402ebded2a7ec8f38809bf907ac72692ede
                - 37d229d0262b6fa7dfb96184eff3f7882ddd487e
                - 8002fd226367c0882973c69673bf8379df2fc198
                - a1c3e0db94579f59cc821132f958187339e68d88
                - 4fdec5a8e10f95a5dbfd84cf382f2755f0342fda
                - ef73d7e235c4d4ab41402835193ac9ba0c4cc485
                - ad3d14f1da33d00ee3506f12922fb3faf87b65d7
                - a1d509759b9195a1c022f2eb9585b74d07a0f084
                - b7e54b0b41757cd36dd03fb29367b385c5fa3be0
                - d909440c48b7b64b016478de1e6ee78e2faa9e13
                - 2ca9dc306e8c667eb9f00376898be52d8b980c88
                - 031524c73df6fd40b13e89c44e86d4a62d77075b
                - 6fae0d4fa68a85a1d552c5ae3140dd39f7a05c88
                - fb27b4238cd6c33bd899e240ead4b5fb8a2a24b1
                - 0890cc54a92627c03119654c94c584a2e3c744ca
                - 339edce03ed7fe59ec4a778abff243fa4cabaa23
                - 2329014b6dbc473326291fa6e101e6d63c4dbd25
                - 872663148e00c4d272fc67e8d369a5012ccbac5a
                - 0e3b1262a168d51512014c4f7df6c37edce0f05d
                - 606d9064b0a6abd82da3731fda9f1558ec1f153c
                - 4bd39999a06fa1f710daae54c6cc8ca7d5784f58
                - 562cd20d05e0427e6b18daa279a3a5f3b08c889d
                - 4bbd44784c7c4eede8e53011a2c4981c16598d1f
                - dc4bd4cece9a6de7926e85a09f152fe4697a8bc5
                - 770e2583907fa38e2b78601a90799b6ae7ab15eb
                - f34b3b765fb964dee979ac7646b6d609adbeb2ba
                - aa10040b570386c1ae311c6245b9e21295b2b83a
                - fff015f4094ab80ff2eb4978f8cdb3711187c50a
                - 5b2be7d9d8444e0a5b706944c878cd0048ef026a
                - 2cd0ee8cf21eecaa9d39d699692284be44cf6ca2
                - 451043367be65468dd96bbf5868af666b25f1663
                - 4fc29224cf362988a741dc07804225f730a326ec
                - dd6bc28afb3bafdde93ad7ed9f58b3a0aec2be99
                - 1597c68f7b941fd97881155d7f077852e2914e7b
                - e59984353acde7207aa1115e261847bf4ddd9a8f
                - ee1000e153e1b7c8f223bb573bb8169d2033f4af
                - 1d3b2589d734dc94a1719a3af40b87ed8319f329
            publicationTime: 2015-08-06T00:00:00Z
            disclosureTime: 2015-05-18T15:59:00Z
            isUpgradable: false
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE:
                - CVE-2015-3627
              CWE:
                - CWE-59
            credit:
              - Tõnis Tiigi
            CVSSv3: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
            cvssScore: 8.4
            patches: []
            upgradePath: []
        licenses: []
    Issues10:
      title: Issues10
      required:
        - vulnerabilities
        - licenses
      type: object
      properties:
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability9'
          description: ''
        licenses:
          type: array
          items:
            type: string
          description: ''
      example:
        vulnerabilities:
          - id: SNYK-RUBY-JSON-20000
            url: https://snyk.io/vuln/SNYK-RUBY-JSON-20000
            title: Denial of Service (DoS)
            type: vuln
            description: >
              ## Overview


              The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.

              Affected versions of this Gem contain an overflow condition. This is triggered when user-supplied input is not properly validated while handling specially crafted data. This can allow a remote attacker to cause a stack-based buffer overflow, resulting in a denial of service, or potentially allowing the [execution of arbitrary code](https://snyk.io/vuln/SNYK-RUBY-JSON-20209).


              ## Details

              Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



              Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



              One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



              When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



              Two common types of DoS vulnerabilities:



              * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



              * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


              ## References

              - http://rubysec.com/advisories/OSVDB-101157
            functions: []
            from:
              - json@1.0.0
            package: json
            version: 1.0.0
            severity: high
            exploitMaturity: no-known-exploit
            language: ruby
            packageManager: rubygems
            semver:
              vulnerable:
                - < 1.1.0
            publicationTime: 2007-05-20T21:00:00Z
            disclosureTime: 2007-05-20T21:00:00Z
            isUpgradable: true
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE: []
              CWE:
                - CWE-400
              OSVDB:
                - OSVDB-101157
            credit:
              - Unknown
            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
            cvssScore: 7.5
            patches: []
            upgradePath:
              - json@1.1.0
          - id: SNYK-RUBY-JSON-20060
            url: https://snyk.io/vuln/SNYK-RUBY-JSON-20060
            title: Denial of Service (DoS)
            type: vuln
            description: >
              ## Overview

              The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.

              Affected versions of this Gem are vulnerable to Denial of Service (DoS) attacks and unsafe object creation vulnerabilities. When parsing certain JSON documents, the JSON gem tricked into creating Ruby symbols in a target system.


              ## Details


              When parsing certain JSON documents, the JSON gem can be coerced in to creating Ruby symbols in a target system.  Since Ruby symbols are not garbage collected, this can result in a denial of service attack.


              The same technique can be used to create objects in a target system that act like internal objects.  These "act alike" objects can be used to bypass certain security mechanisms and can be used as a spring board for SQL injection attacks in Ruby on Rails.


              Impacted code looks like this:

              ```js

              JSON.parse(user_input)

              ```

              Where the `user_input` variable will have a JSON document like this:

              ```json

              {"json_class":"foo"}

              ```

              The JSON gem will attempt to look up the constant "foo".  Looking up this constant will create a symbol.


              In JSON version 1.7.x, objects with arbitrary attributes can be created using JSON documents like this:

              ```json

              {"json_class":"JSON::GenericObject","foo":"bar"}

              ```

              This document will result in an instance of `JSON::GenericObject`, with the attribute "foo" that has the value "bar".  Instantiating these objects will result in arbitrary symbol creation and in some cases can be used to bypass security measures.


              PLEASE NOTE: this behavior *does not change* when using `JSON.load`.  `JSON.load` should *never* be given input from unknown sources.  If you are processing JSON from an unknown source, *always* use `JSON.parse`.


              ## References

              - https://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/

              - https://gist.github.com/rsierra/4943505
            functions: []
            from:
              - json@1.0.0
            package: json
            version: 1.0.0
            severity: high
            exploitMaturity: no-known-exploit
            language: ruby
            packageManager: rubygems
            semver:
              vulnerable:
                - < 1.7.7, >= 1.7
                - < 1.6.8, >= 1.6
                - < 1.5.5
            publicationTime: 2013-02-10T22:00:00Z
            disclosureTime: 2013-02-10T22:00:00Z
            isUpgradable: true
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE:
                - CVE-2013-0269
              CWE:
                - CWE-400
              OSVDB:
                - OSVDB-90074
            credit:
              - Thomas Hollstegge
              - Ben Murphy
            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
            cvssScore: 7.3
            patches: []
            upgradePath:
              - json@1.5.5
          - id: SNYK-RUBY-JSON-20209
            url: https://snyk.io/vuln/SNYK-RUBY-JSON-20209
            title: Arbitrary Code Execution
            type: vuln
            description: >
              ## Overview


              The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.


              Affected versions of this Gem contain an overflow condition. This is triggered when user-supplied input is not properly validated while handling specially crafted data. This can allow a remote attacker to cause a stack-based buffer overflow, resulting in a [denial of service](https://snyk.io/vuln/SNYK-RUBY-JSON-20000), or potentially allowing the execution of arbitrary code.


              ## References


              - http://rubysec.com/advisories/OSVDB-101157
            functions: []
            from:
              - json@1.0.0
            package: json
            version: 1.0.0
            severity: high
            exploitMaturity: no-known-exploit
            language: ruby
            packageManager: rubygems
            semver:
              vulnerable:
                - < 1.1.0
            publicationTime: 2007-05-20T21:00:00Z
            disclosureTime: 2007-05-20T21:00:00Z
            isUpgradable: true
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE: []
              CWE:
                - CWE-94
              OSVDB:
                - OSVDB-101157-1
            credit:
              - Unknown
            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
            cvssScore: 7.5
            patches: []
            upgradePath:
              - json@1.1.0
          - id: SNYK-RUBY-RACK-538324
            url: https://snyk.io/vuln/SNYK-RUBY-RACK-538324
            title: Information Exposure
            type: vuln
            description: >
              ## Overview


              [rack](https://rack.github.io/) is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.



              Affected versions of this package are vulnerable to Information Exposure.

              Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.


              ## Remediation


              Upgrade `rack` to version 1.6.12, 2.0.8 or higher.



              ## References


              - [GitHub Fix Commit](https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38)


              - [GitHub Security Advisory](https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3)
            functions: []
            from:
              - redis-rack-cache@1.1
              - rack-cache@1.1
              - rack@2.0.1
            package: rack
            version: 2.0.1
            severity: medium
            exploitMaturity: no-known-exploit
            language: ruby
            packageManager: rubygems
            semver:
              vulnerable:
                - <1.6.12
                - '>=2.0.0.alpha, <2.0.8'
            publicationTime: 2019-12-19T20:24:49Z
            disclosureTime: 2019-12-18T20:24:49Z
            isUpgradable: true
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE:
                - CVE-2019-16782
              CWE:
                - CWE-200
            credit:
              - Will Leinweber
            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
            cvssScore: 5.3
            patches: []
            upgradePath:
              - redis-rack-cache@1.1
              - rack-cache@1.1
              - rack@2.0.8
          - id: SNYK-RUBY-RACK-72567
            url: https://snyk.io/vuln/SNYK-RUBY-RACK-72567
            title: Cross-site Scripting (XSS)
            type: vuln
            description: >
              ## Overview


              [rack](https://rack.github.io/) is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.



              Affected versions of this package are vulnerable to Cross-site Scripting (XSS)

              via the `scheme` method on `Rack::Request`.


              ## Remediation


              Upgrade `rack` to version 1.6.11, 2.0.6 or higher.



              ## References


              - [GitHub Commit](https://github.com/rack/rack/commit/313dd6a05a5924ed6c82072299c53fed09e39ae7)


              - [Google Security Forum](https://groups.google.com/forum/#!msg/rubyonrails-security/GKsAFT924Ag/DYtk-Xl6AAAJ)


              - [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1646818)
            functions: []
            from:
              - redis-rack-cache@1.1
              - rack-cache@1.1
              - rack@2.0.1
            package: rack
            version: 2.0.1
            severity: medium
            exploitMaturity: no-known-exploit
            language: ruby
            packageManager: rubygems
            semver:
              vulnerable:
                - <1.6.11
                - '>=2.0.0, <2.0.6'
            publicationTime: 2018-11-06T16:08:37Z
            disclosureTime: 2018-08-22T15:56:49Z
            isUpgradable: true
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE:
                - CVE-2018-16470
              CWE:
                - CWE-79
            credit:
              - Aaron Patterson
            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
            cvssScore: 6.1
            patches: []
            upgradePath:
              - redis-rack-cache@1.1
              - rack-cache@1.1
              - rack@2.0.6
          - id: SNYK-RUBY-RACKCACHE-20031
            url: https://snyk.io/vuln/SNYK-RUBY-RACKCACHE-20031
            title: HTTP Header Caching Weakness
            type: vuln
            description: >
              ## Overview

              [rack-cache](https://rubygems.org/gems/rack-cache) enables HTTP caching for Rack-based applications.

              Affected versions of this gem contain a flaw related to the rubygem caching sensitive HTTP headers. This will result in a weakness that may make it easier for an attacker to gain access to a user's session via a specially crafted header.


              ## References

              - http://rubysec.com/advisories/CVE-2012-2671
            functions: []
            from:
              - redis-rack-cache@1.1
              - rack-cache@1.1
            package: rack-cache
            version: '1.1'
            severity: high
            exploitMaturity: no-known-exploit
            language: ruby
            packageManager: rubygems
            semver:
              vulnerable:
                - < 1.2
            publicationTime: 2012-06-05T21:00:00Z
            disclosureTime: 2012-06-05T21:00:00Z
            isUpgradable: true
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE:
                - CVE-2012-2671
              CWE:
                - CWE-444
              OSVDB:
                - OSVDB-83077
            credit:
              - Unknown
            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
            cvssScore: 7.3
            patches: []
            upgradePath:
              - redis-rack-cache@1.2
              - rack-cache@1.2
          - id: SNYK-RUBY-REDISSTORE-20452
            url: https://snyk.io/vuln/SNYK-RUBY-REDISSTORE-20452
            title: Deserialization of Untrusted Data
            type: vuln
            description: >
              ## Overview

              [`redis-store`](https://rubygems.org/gems/redis-store) is a namespaced Rack::Session, Rack::Cache, I18n and cache Redis stores for Ruby web frameworks.


              Affected versions of the package are vulnerable to Deserialization of Untrusted Data.


              # Details

              Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.


              _Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.


              An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.


              ## Remediation

              Upgrade `redis-store` to version 1.4.0 or higher.


              ## References

              - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-1000248)

              - [GitHub PR](https://github.com/redis-store/redis-store/pull/290)

              - [GitHub Issue](https://github.com/redis-store/redis-store/issues/289)

              - [GitHub Commit](https://github.com/redis-store/redis-store/commit/e0c1398d54a9661c8c70267c3a925ba6b192142e)
            functions: []
            from:
              - redis-rack-cache@1.1
              - redis-store@1.1.0
            package: redis-store
            version: 1.1.0
            severity: critical
            exploitMaturity: no-known-exploit
            language: ruby
            packageManager: rubygems
            semver:
              vulnerable:
                - <1.4.0
            publicationTime: 2017-12-07T09:52:33.659000Z
            disclosureTime: 2017-08-10T21:00:00Z
            isUpgradable: true
            isPatchable: false
            isPinnable: false
            identifiers:
              CVE:
                - CVE-2017-1000248
              CWE:
                - CWE-502
            credit:
              - Dylan Katz
            CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
            cvssScore: 9.8
            patches: []
            upgradePath:
              - redis-rack-cache@2.0.2
              - redis-store@1.4.0
        licenses: []
    Issues14:
      title: Issues14
      required:
        - vulnerabilities
        - licenses
      type: object
      properties:
        vulnerabilities:
          type: array
          items:
            $ref: '#/components/schemas/Vulnerability13'
          description: ''
        licenses:
          type: array
          items:
            $ref: '#/components/schemas/Licenses3'
          description: ''
    Issues18:
      title: Issues18
      required:
        - pkgName
        - pkgVersion
        - issueId
        - fixInfo
      type: object
      properties:
        pkgName:
          type: string
        pkgVersion:
          type: string
        issueId:
          type: string
        fixInfo:
          type: object
      example:
        pkgName: ch.qos.logback:logback-core
        pkgVersion: 1.0.13
        issueId: SNYK-JAVA-CHQOSLOGBACK-30208
        fixInfo: {}
    IssuesData:
      title: IssuesData
      required:
        - SNYK-JAVA-CHQOSLOGBACK-30208
      type: object
      properties:
        SNYK-JAVA-CHQOSLOGBACK-30208:
          $ref: '#/components/schemas/SNYKJAVACHQOSLOGBACK30208'
    issueSeverity:
      title: issueSeverity
      enum:
        - all
        - high
      type: string
      description: The severity levels of issues to send notifications for (only applicable for `new-remediations-vulnerabilities` notificationType)
      example: high
    issuesPrevented:
      title: issuesPrevented
      type: object
      properties:
        'true':
          type: number
          description: The number of tests that prevented issues from being introduced
        'false':
          type: number
          description: The number of tests that did not prevent issues from being introduced
    issueType:
      title: issueType
      enum:
        - all
        - vuln
        - license
        - none
      type: string
      description: Filter the types of issue to include in notifications (only applicable for `new-remediations-vulnerabilities` notificationType)
      example: vuln
    jiraIssue1:
      title: jiraIssue1
      type: object
      properties:
        id:
          type: string
          description: The id of the issue in Jira.
        key:
          type: string
          description: The key of the issue in Jira.
      description: The details about the jira issue.
    license:
      title: license
      required:
        - low
        - medium
        - high
        - critical
      type: object
      properties:
        low:
          type: number
          description: Number of low severity vulnerabilities
        medium:
          type: number
          description: Number of medium severity vulnerabilities
        high:
          type: number
          description: Number of high severity vulnerabilities
        critical:
          type: number
          description: Number of critical severity vulnerabilities
    Licenses1:
      title: Licenses1
      required:
        - id
        - url
        - title
        - type
        - from
        - package
        - version
        - severity
        - language
        - packageManager
        - semver
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        title:
          type: string
        type:
          type: string
        from:
          type: array
          items:
            type: string
          description: ''
        package:
          type: string
        version:
          type: string
        severity:
          type: string
        language:
          type: string
        packageManager:
          type: string
        semver:
          $ref: '#/components/schemas/Semver7'
      example:
        id: snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
        url: http://localhost:34612/vuln/snyk:lic:golang:github.com:hashicorp:hcl:MPL-2.0
        title: MPL-2.0 license
        type: license
        from:
          - github.com/hashicorp/hcl/json/token@v1.0.0
        package: github.com/hashicorp/hcl/json/token
        version: v1.0.0
        severity: medium
        language: golang
        packageManager: golang
        semver:
          vulnerable:
            - '>=0'
          vulnerableHashes:
            - '*'
    licenses2:
      title: licenses2
      required:
        - id
        - title
        - license
      type: object
      properties:
        id:
          type: string
          description: The identifier of the license
        title:
          type: string
          description: The title of the license
        license:
          type: string
          description: The type of the license
    Licenses3:
      title: Licenses3
      required:
        - id
        - url
        - title
        - type
        - from
        - package
        - version
        - severity
        - language
        - packageManager
        - semver
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        title:
          type: string
        type:
          type: string
        from:
          type: array
          items:
            type: string
          description: ''
        package:
          type: string
        version:
          type: string
        severity:
          type: string
        language:
          type: string
        packageManager:
          type: string
        semver:
          $ref: '#/components/schemas/Semver2'
      example:
        id: snyk:lic:maven:net.databinder.dispatch:dispatch-core_2.11:LGPL-3.0
        url: https://snyk.io/vuln/snyk:lic:maven:net.databinder.dispatch:dispatch-core_2.11:LGPL-3.0
        title: LGPL-3.0 license
        type: license
        from:
          - net.databinder.dispatch:dispatch-core_2.11@0.11.2
        package: net.databinder.dispatch:dispatch-core_2.11
        version: 0.11.2
        severity: medium
        language: java
        packageManager: maven
        semver:
          vulnerable:
            - '[0,)'
    lifecycle:
      title: lifecycle
      enum:
        - production
        - development
        - sandbox
      type: string
    links:
      title: links
      type: object
      properties:
        paths:
          type: string
          description: The URL for the dependency paths that introduce this issue
      description: Onward links from this record (Non-IaC projects only)
    issuePathsLinks:
      title: issuePathsLinks
      type: object
      properties:
        prev:
          type: string
          description: The URL of the previous page of paths for the issue, if not on the first page
        next:
          type: string
          description: The URL of the next page of paths for the issue, if not on the last page
        last:
          type: string
          description: The URL of the last page of paths for the issue
      description: Onward links from this record
    Listallentitlementsresponse:
      title: Listallentitlementsresponse
      required:
        - licenses
        - reports
        - fullVulnDB
      type: object
      properties:
        licenses:
          type: boolean
        reports:
          type: boolean
        fullVulnDB:
          type: boolean
      example:
        licenses: true
        reports: true
        fullVulnDB: false
    Listallmembersinagroupresponse:
      title: Listallmembersinagroupresponse
      type: object
      properties:
        id:
          type: string
          description: The id of the user.
        name:
          type: string
          description: The name of the user.
        username:
          type: string
          description: The username of the user.
        email:
          type: string
          description: The email of the user (email is null if the member is a service account).
        orgs:
          type: array
          items:
            $ref: '#/components/schemas/orgs'
          description: ''
        groupRole:
          type: string
          description: (Optional) The role of the user in the group.
    Listallorganizationsinagroupresponse:
      title: Listallorganizationsinagroupresponse
      required:
        - id
        - name
        - url
        - created
        - orgs
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        url:
          type: string
        created:
          type: string
        orgs:
          type: array
          items:
            $ref: '#/components/schemas/Orgs1'
          description: ''
      example:
        id: a060a49f-636e-480f-9e14-38e773b2a97f
        name: ACME Inc.
        url: https://api.snyk.io/v1/group/0dfc509a-e7a9-48ef-9d39-649d6468fc09
        created: 2021-06-07T00:00:00.000Z
        orgs:
          - name: myDefaultOrg
            id: 689ce7f9-7943-4a71-b704-2ba575f01089
            slug: my-default-org
            url: https://api.snyk.io/v1/org/default-org
            created: 2021-06-07T00:00:00.000Z
          - name: My Other Org
            id: a04d9cbd-ae6e-44af-b573-0556b0ad4bd2
            slug: my-other-org
            url: https://api.snyk.io/v1/org/my-other-org
            created: 2021-06-07T00:00:00.000Z
    Listallrolesinagroupresponse:
      title: Listallrolesinagroupresponse
      required:
        - name
        - description
        - publicId
        - created
        - modified
      type: object
      properties:
        name:
          type: string
        description:
          type: string
        publicId:
          type: string
        created:
          type: string
        modified:
          type: string
      example:
        name: Org Collaborator
        description: Collaborator
        publicId: 6525b356-a400-465f-b2e5-3eee1161e69f
        created: 2021-04-22T16:02:53.233Z
        modified: 2021-04-22T16:02:53.332Z
    Listalltagsinagroupresponse:
      title: Listalltagsinagroupresponse
      type: object
      properties:
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Tagbody'
          description: ''
    Listalltheorganizationsauserbelongstoresponse:
      title: Listalltheorganizationsauserbelongstoresponse
      required:
        - orgs
      type: object
      properties:
        orgs:
          type: array
          items:
            $ref: '#/components/schemas/Orgs2'
          description: ''
    ListMembersresponse:
      title: ListMembersresponse
      type: object
      properties:
        id:
          type: string
          description: The id of the user.
        name:
          type: string
          description: The name of the user.
        username:
          type: string
          description: The username of the user.
        email:
          type: string
          description: The email of the user.
        role:
          type: string
          description: The role of the user in the organization.
    Listpendinguserprovisionsresponse:
      title: Listpendinguserprovisionsresponse
      type: object
      properties:
        email:
          type: string
          description: The email of the user.
        role:
          type: string
          description: Name of the role granted for this user.
        rolePublicId:
          type: string
          description: ID of the role to granted for this user.
        created:
          type: string
          description: Timestamp of when this provision record was created.
    Listwebhooksresponse:
      title: Listwebhooksresponse
      required:
        - results
        - total
      type: object
      properties:
        results:
          type: array
          items:
            $ref: '#/components/schemas/Results6'
          description: ''
        total:
          type: integer
          format: int32
      example:
        results:
          - id: d3cf26b3-2d77-497b-bce2-23b33cc15362
            url: https://my.app.com/webhook-handler/snyk123
        total: 1
    logs:
      title: logs
      type: object
      properties:
        name:
          type: string
          description: the name of an organization
        created:
          type: string
          description: the time when the importing the organization was attempted represented as a [UTC (ISO-8601)](https://tools.ietf.org/html/rfc3339) string
        status:
          type: string
          description: >-
            a string representing the status of the attempted import


            One of: pending, failed, aborted or complete.
        truncated:
          type: boolean
          description: a flag indicating if the import was truncated
        projects:
          type: array
          items:
            $ref: '#/components/schemas/projects3'
          description: projects assigned to the imported organization
    manualRemediationPrs:
      title: manualRemediationPrs
      type: object
      properties:
        usePatchRemediation:
          type: boolean
          description: If true, allows using patched remediation
      description: Defines manual remediation policies
    MavenModuleName:
      title: MavenModuleName
      required:
        - artifactId
        - groupId
      type: object
      properties:
        artifactId:
          type: string
        groupId:
          type: string
      example:
        artifactId: logback-core
        groupId: ch.qos.logback
    method:
      title: method
      enum:
        - api
        - cli
        - recurring
        - web
        - web-test
        - wizard
      type: string
      description: The method by which this snapshot was created.
    Modifyprojectnotificationsettingsrequest:
      title: Modifyprojectnotificationsettingsrequest
      type: object
      properties:
        new-issues-remediations:
          $ref: '#/components/schemas/Newissuesnotificationsettingrequest'
    MonitorDepGraphresponse:
      title: MonitorDepGraphresponse
      required:
        - ok
        - id
        - uri
      type: object
      properties:
        ok:
          type: boolean
        id:
          type: string
        uri:
          type: string
      example:
        ok: true
        id: f7c065cd-5850-462d-a0ca-9719d07e3e38
        uri: https://app.snyk.io/org/my-org/project/f7c065cd-5850-462d-a0ca-9719d07e3e38/history/39d14036-31f3-4f22-8037-1d979e0516ef
    Moveprojecttoadifferentorganizationresponse:
      title: Moveprojecttoadifferentorganizationresponse
      required:
        - originOrg
        - destinationOrg
        - movedProject
      type: object
      properties:
        originOrg:
          type: string
        destinationOrg:
          type: string
        movedProject:
          type: string
      example:
        originOrg: 4a18d42f-0706-4ad0-b127-24078731fbed
        destinationOrg: 4a18d42f-0706-4ad0-b127-24078731fbed
        movedProject: 463c1ee5-31bc-428c-b451-b79a3270db08
    NexusCrCredentials:
      title: NexusCrCredentials
      required:
        - username
        - password
        - registryBase
      type: object
      properties:
        username:
          type: string
        password:
          type: string
        registryBase:
          type: string
          description: 'e.g.: `your.nexus.host`'
    nodes:
      title: nodes
      required:
        - nodeId
        - pkgId
        - deps
      type: object
      properties:
        nodeId:
          type: string
          description: The internal id of the node
        pkgId:
          type: string
          description: The id of the package
        deps:
          type: array
          items:
            $ref: '#/components/schemas/deps'
          description: A list of the direct dependencies of the package
    order:
      title: order
      enum:
        - asc
        - desc
      type: string
    org:
      title: org
      type: object
      properties:
        name:
          type: string
        id:
          type: string
          description: The identifier of the org
    Org1:
      title: Org1
      required:
        - name
        - id
      type: object
      properties:
        name:
          type: string
        id:
          type: string
      example:
        name: atokeneduser
        id: 689ce7f9-7943-4a71-b704-2ba575f01089
    orgs:
      title: orgs
      type: object
      properties:
        name:
          type: string
          description: The name of the organization
        role:
          type: string
          description: the role of the user in the organization
    Orgs1:
      title: Orgs1
      required:
        - name
        - id
        - slug
        - url
        - created
      type: object
      properties:
        name:
          type: string
        id:
          type: string
        slug:
          type: string
        url:
          type: string
        created:
          type: string
      example:
        name: myDefaultOrg
        id: 689ce7f9-7943-4a71-b704-2ba575f01089
        slug: my-default-org
        url: https://api.snyk.io/v1/org/default-org
        created: 2021-06-07T00:00:00.000Z
    Orgs2:
      title: Orgs2
      required:
        - name
        - id
        - slug
        - url
        - group
      type: object
      properties:
        name:
          type: string
        id:
          type: string
        slug:
          type: string
        url:
          type: string
        group:
          oneOf:
            - allOf:
                - oneOf:
                    - nullable: true
                    - $ref: '#/components/schemas/Group'
                - {}
            - allOf:
                - $ref: '#/components/schemas/Group1'
                - example:
                    name: ACME Inc.
                    id: a060a49f-636e-480f-9e14-38e773b2a97f
            - nullable: true
    owner:
      title: owner
      type: object
      properties:
        id:
          type: string
          description: A user to assign as the project owner.
          example: 1acd4d09-5602-4d04-9640-045fe928aaea
      description: Set to `null` to remove all ownership. User must be a member of the same organization as the project.
    patches:
      title: patches
      type: object
      properties:
        id:
          type: string
          description: The identifier of the patch
          example: patch:npm:ms:20170412:0
        urls:
          type: array
          items:
            type: string
          description: The URLs where the patch files can be downloaded
        version:
          type: string
          description: The version number(s) that the patch can be applied to
          example: =1.0.0
        comments:
          type: array
          items:
            type: string
          description: Any comments about the patch
        modificationTime:
          type: string
          description: When the patch was last modified
          example: 2019-12-03T11:40:45.863964Z
    Patches2:
      title: Patches2
      required:
        - comments
        - id
        - modificationTime
        - urls
        - version
      type: object
      properties:
        comments:
          type: array
          items:
            type: string
          description: ''
        id:
          type: string
        modificationTime:
          type: string
        urls:
          type: array
          items:
            type: string
          description: ''
        version:
          type: string
      example:
        comments: []
        id: patch:npm:ms:20151024:5
        modificationTime: 2019-12-03T11:40:45.777474Z
        urls:
          - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_5_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk5.patch
        version: =0.1.0
    pip_Testforissuesinapublicpackagebynameandversionresponse:
      title: pip_Testforissuesinapublicpackagebynameandversionresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues1'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
      example:
        ok: false
        issues:
          vulnerabilities:
            - id: SNYK-PYTHON-RSA-40541
              url: https://snyk.io/vuln/SNYK-PYTHON-RSA-40541
              title: Timing Attack
              type: vuln
              description: >
                ## Overview

                [`rsa`](https://pypi.python.org/pypi/rsa) is a Pure-Python RSA implementation.


                Affected versions of this package are vulnerable to Timing attacks.


                ## References

                - [GitHub Issue](https://github.com/sybrenstuvel/python-rsa/issues/19)

                - [GitHub Commit](https://github.com/sybrenstuvel/python-rsa/commit/2310b34bdb530e0bad793d42f589c9f848ff181b)
              functions: []
              from:
                - rsa@3.3
              package: rsa
              version: '3.3'
              severity: medium
              exploitMaturity: no-known-exploit
              language: python
              packageManager: pip
              semver:
                vulnerable:
                  - '[3.0,3.4.0)'
              publicationTime: 2013-11-15T02:34:45.265000Z
              disclosureTime: 2013-11-15T02:34:45.265000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: true
              identifiers:
                CVE: []
                CWE:
                  - CWE-208
              credit:
                - Manuel Aude Morales
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 5.3
              patches: []
              upgradePath: []
            - id: SNYK-PYTHON-RSA-40542
              url: https://snyk.io/vuln/SNYK-PYTHON-RSA-40542
              title: Authentication Bypass
              type: vuln
              description: >
                ## Overview

                [`rsa`](https://pypi.python.org/pypi/rsa) is a Pure-Python RSA implementation.


                Affected versions of this package are vulnerable to Authentication Bypass due to not implementing authentication encryption or use MACs to validate messages before decrypting public key encrypted messages.


                ## References

                - [GitHub Issue](https://github.com/sybrenstuvel/python-rsa/issues/13)

                - [GitHub Commit](https://github.com/sybrenstuvel/python-rsa/commit/1681a0b2f84a4a252c71b87de870a2816de06fdf)
              functions: []
              from:
                - rsa@3.3
              package: rsa
              version: '3.3'
              severity: high
              exploitMaturity: no-known-exploit
              language: python
              packageManager: pip
              semver:
                vulnerable:
                  - '[3.0,3.4)'
              publicationTime: 2012-12-07T03:15:00.052000Z
              disclosureTime: 2012-12-07T03:15:00.052000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: true
              identifiers:
                CVE: []
                CWE:
                  - CWE-287
              credit:
                - Sergio Lerner
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
              cvssScore: 7.5
              patches: []
              upgradePath: []
          licenses: []
        dependencyCount: 2
        org:
          name: gitphill
          id: 229b76f3-802c-4553-aa1d-01d4d86f7f61
        licensesPolicy: null
        packageManager: pip
    pkgManager2:
      title: pkgManager2
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: The name of the package manager
        version:
          type: string
          description: The version of the package manager
        repositories:
          type: array
          items:
            $ref: '#/components/schemas/repositories'
          description: ''
      description: The package manager of the project
    pkgs:
      title: pkgs
      required:
        - id
        - info
      type: object
      properties:
        id:
          type: string
          description: The internal id of the package
        info:
          $ref: '#/components/schemas/info'
    priority:
      title: priority
      type: object
      properties:
        score:
          type: number
          description: The priority score of the issue
          example: 399
        factors:
          type: array
          items:
            type: object
          description: The list of factors that contributed to the priority of the issue
      description: Information about the priority of the issue (Non-IaC projects only)
    priority1:
      title: priority1
      type: object
      properties:
        score:
          $ref: '#/components/schemas/score'
      description: The priority to filter the issues by (Non-IaC projects only)
    priorityScore2:
      title: priorityScore2
      type: object
      properties:
        min:
          type: number
          example: 0
        max:
          type: number
          example: 1000
      description: Include issues that have a priority score between `min` and `max`
    project1:
      title: project1
      required:
        - url
        - id
        - name
        - source
        - packageManager
      type: object
      properties:
        url:
          type: string
          description: URL to a page containing information about the project
        id:
          type: string
          description: The identifier of the project
        name:
          type: string
          description: The name of the project
        source:
          type: string
          description: The source of the project (e.g. github, heroku etc)
        packageManager:
          type: string
          description: The package manager for the project (e.g. npm, rubygems etc)
        targetFile:
          type: string
          description: The file path to the dependency manifest or lock file (e.g. package.json, Gemfile.lock etc)
      description: When no `groupBy` is used, a single project is returned per issue
    projects:
      title: projects
      required:
        - id
        - name
      type: object
      properties:
        id:
          type: string
          description: The identifier of the project
        name:
          type: string
          description: The name of the project
    projects2:
      title: projects2
      required:
        - url
        - id
        - name
        - source
        - packageManager
      type: object
      properties:
        url:
          type: string
          description: URL to a page containing information about the project
        id:
          type: string
          description: The identifier of the project
        name:
          type: string
          description: The name of the project
        source:
          type: string
          description: The source of the project (e.g. github, heroku etc)
        packageManager:
          type: string
          description: The package manager for the project (e.g. npm, rubygems etc)
        targetFile:
          type: string
          description: The file path to the dependency manifest or lock file (e.g. package.json, Gemfile.lock etc)
    projects3:
      title: projects3
      type: object
      properties:
        targetFile:
          type: string
          description: the project's package manifest file
        success:
          type: boolean
          description: specifies if the project was successfully imported
        projectUrl:
          type: string
          description: the URL to the project
        projectId:
          type: string
          description: the Snyk project publicId
    Provisionnewbrokertokenresponse:
      title: Provisionnewbrokertokenresponse
      required:
        - id
        - provisionalBrokerToken
      type: object
      properties:
        id:
          type: string
        provisionalBrokerToken:
          type: string
      example:
        id: 9a3e5d90-b782-468a-a042-9a2073736f0b
        provisionalBrokerToken: 4a18d42f-0706-4ad0-b127-24078731fbed
    QuayCrCredentials:
      title: QuayCrCredentials
      required:
        - username
        - password
        - registryBase
      type: object
      properties:
        username:
          type: string
        password:
          type: string
        registryBase:
          type: string
          description: 'e.g.: `quay.io`, `your.quay.host`'
    reasonType:
      title: reasonType
      enum:
        - not-vulnerable
        - wont-fix
        - temporary-ignore
      type: string
      description: The classification of the ignore.
    remediation:
      title: remediation
      type: object
      properties:
        upgrade:
          type: object
          description: >-
            Recommended upgrades to apply to the project

            (object)
                + upgradeTo (string, required) - `package@version` to upgrade to
                + upgrades (array[string], required) -  List of `package@version` that will be upgraded as part of this upgrade
                + vulns (array[string], required) - List of vulnerability ids that will be fixed as part of this upgrade
        patch:
          type: object
          description: >-
            Recommended patches to apply to the project

            (object)
               paths (array) - List of paths to the vulnerable dependency that can be patched
        pin:
          type: object
          description: >-
            Recommended pins to apply to the project (Python only)


            (object)
                + upgradeTo (string, required) - `package@version` to upgrade to
                + vulns (array[string], required) - List of vulnerability ids that will be fixed as part of this upgrade
                + isTransitive (boolean) - Describes if the dependency to be pinned is a transitive dependency
      description: Remediation data (if available)
    Removeatagfromaprojectresponse:
      title: Removeatagfromaprojectresponse
      type: object
      properties:
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: Tags now applied to the project
    repositories:
      title: repositories
      required:
        - alias
      type: object
      properties:
        alias:
          type: string
    request:
      title: request
      type: object
      properties:
        url:
          type: string
          description: Webhooks can only be configured for URLs using the `https` protocol. `http` is not allowed.
        secret:
          type: string
          description: 'This is a password you create, that Snyk uses to sign our transports to you, so you be sure the notification is authentic. Your `secret` should: Be a random string with high entropy; Not be used for anything else; Only known to Snyk and your webhook transport consuming code;'
    requestAccess:
      title: requestAccess
      required:
        - enabled
      type: object
      properties:
        enabled:
          type: boolean
          description: Choose whether a user may request access to Snyk orgs in this group that they are not a member of.
          example: true
      description: Can only be updated if `API_KEY` has edit access to request access settings.
    requestAccess1:
      title: requestAccess1
      required:
        - enabled
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether requesting access to the organization is enabled.
          example: true
      description: Will only be returned if `API_KEY` has read access to request access settings.
    orgIgnoreSettings:
      title: orgIgnoreSettings
      type: object
      properties:
        autoApproveIgnores:
          type: boolean
          description: Whether pending ignores can be auto-approved.
          example: false
        reasonRequired:
          type: boolean
          description: Whether a reason is required for creating ignores.
          example: false
        approvalWorkflowEnabled:
          type: boolean
          description: Whether Ignore Approval Workflow is enabled.
          example: false
      description: Will only be returned if `API_KEY` has read access to ignore settings.
    requestAccess2:
      title: requestAccess2
      required:
        - enabled
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether requesting access to the organization is enabled.
          example: true
      description: Can only be updated if `API_KEY` has edit access to request access settings.
    results:
      title: results
      required:
        - id
        - name
        - version
        - type
        - licenses
        - projects
      type: object
      properties:
        id:
          type: string
          description: The identifier of the package
        name:
          type: string
          description: The name of the package
        version:
          type: string
          description: The version of the package
        latestVersion:
          type: string
          description: The latest version available for the specified package
        latestVersionPublishedDate:
          type: string
          description: The timestamp for when the latest version of the specified package was published.
        firstPublishedDate:
          type: string
          description: The timestamp for when the specified package was first published.
        isDeprecated:
          type: boolean
          description: True if the latest version of the package is marked as deprecated; False otherwise.
        deprecatedVersions:
          type: array
          items:
            type: string
          description: The numbers for those versions that are marked as deprecated
        dependenciesWithIssues:
          type: array
          items:
            type: string
          description: The identifiers of dependencies with issues that are depended upon as a result of this dependency
        type:
          type: string
          description: The package type of the dependency
        issuesCritical:
          type: number
          description: The number of critical severity issues in this dependency
        issuesHigh:
          type: number
          description: The number of high severity issues in this dependency
        issuesMedium:
          type: number
          description: The number of medium severity issues in this dependency
        issuesLow:
          type: number
          description: The number of low severity issues in this dependency
        licenses:
          type: array
          items:
            $ref: '#/components/schemas/licenses2'
          description: The licenses of the dependency
        projects:
          type: array
          items:
            $ref: '#/components/schemas/projects'
          description: The projects which depend on the dependency
    results1:
      title: results1
      required:
        - id
        - dependencies
        - projects
      type: object
      properties:
        id:
          type: string
          description: The identifier of the license
        severity:
          allOf:
            - $ref: '#/components/schemas/severity'
            - description: The severity assigned to this license
              example: none
        instructions:
          type: string
          description: Custom instructions assigned to this license
        dependencies:
          type: array
          items:
            $ref: '#/components/schemas/dependencies1'
          description: The dependencies of projects in the organization which have the license
        projects:
          type: array
          items:
            $ref: '#/components/schemas/projects'
          description: The projects which contain the license
    results2:
      title: results2
      required:
        - issue
        - isFixed
        - introducedDate
      type: object
      properties:
        issue:
          $ref: '#/components/schemas/issue'
        isFixed:
          type: boolean
          description: Whether the issue has been fixed
        introducedDate:
          type: string
          description: The date that the issue was introduced into the project
        patchedDate:
          type: string
          description: The date that the issue was patched
        fixedDate:
          type: string
          description: The date that the issue was fixed
    results3:
      title: results3
      required:
        - day
        - count
      type: object
      properties:
        day:
          type: string
          description: The date in the format `YYYY-MM-DD`
        count:
          type: number
          description: The number of issues
        severity:
          $ref: '#/components/schemas/severity1'
        fixable:
          $ref: '#/components/schemas/fixable'
    results4:
      title: results4
      required:
        - day
        - count
      type: object
      properties:
        day:
          type: string
          description: The date in the format `YYYY-MM-DD`
        count:
          type: number
          description: The number of projects
    results5:
      title: results5
      required:
        - count
      type: object
      properties:
        count:
          type: number
          description: The number of tests conducted
        isPrivate:
          $ref: '#/components/schemas/isPrivate'
        issuesPrevented:
          $ref: '#/components/schemas/issuesPrevented'
    Results6:
      title: Results6
      required:
        - id
        - url
      type: object
      properties:
        id:
          type: string
        url:
          type: string
      example:
        id: d3cf26b3-2d77-497b-bce2-23b33cc15362
        url: https://my.app.com/webhook-handler/snyk123
    Retrieveawebhookresponse:
      title: Retrieveawebhookresponse
      required:
        - id
        - url
      type: object
      properties:
        id:
          type: string
        url:
          type: string
      example:
        id: d3cf26b3-2d77-497b-bce2-23b33cc15362
        url: https://my.app.com/webhook-handler/snyk123
    sast:
      title: sast
      required:
        - low
        - medium
        - high
        - critical
      type: object
      properties:
        low:
          type: number
          description: Number of low severity vulnerabilities
        medium:
          type: number
          description: Number of medium severity vulnerabilities
        high:
          type: number
          description: Number of high severity vulnerabilities
        critical:
          type: number
          description: Number of critical severity vulnerabilities
    sbt_Testforissuesinapublicpackagebygroupidartifactidandversionresponse:
      title: sbt_Testforissuesinapublicpackagebygroupidartifactidandversionresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues1'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
    score:
      title: score
      type: object
      properties:
        min:
          type: number
          example: 0
        max:
          type: number
          example: 1000
      description: Include issues where the priority score is between min and max
    semver:
      title: semver
      type: object
      properties:
        vulnerable:
          type: array
          items:
            type: string
          description: The ranges that are vulnerable to the issue. May be an array or a string.
        unaffected:
          type: string
          description: The ranges that are unaffected by the issue
      description: The ranges that are vulnerable and unaffected by the issue (Non-IaC projects only)
    semver1:
      title: semver1
      type: object
      properties:
        vulnerable:
          type: array
          items:
            type: string
          description: The ranges that are vulnerable to the issue
        unaffected:
          type: string
          description: The ranges that are unaffected by the issue
      description: The ranges that are vulnerable and unaffected by the issue
    Semver2:
      title: Semver2
      required:
        - vulnerable
      type: object
      properties:
        vulnerable:
          type: array
          items:
            type: string
          description: ''
      example:
        vulnerable:
          - '[,4.7.3)'
    Semver6:
      title: Semver6
      required:
        - hashesRange
        - vulnerable
        - vulnerableHashes
      type: object
      properties:
        hashesRange:
          type: array
          items:
            type: string
          description: ''
        vulnerable:
          type: array
          items:
            type: string
          description: ''
        vulnerableHashes:
          type: array
          items:
            type: string
          description: ''
      example:
        hashesRange:
          - '>=0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c <d91630c8510268e75203009fe7daf2b8e1d60c45'
        vulnerable:
          - =1.2.0
        vulnerableHashes:
          - c596ec57260fd2ad47b2ae6809d6890a2f99c3b2
          - 36e9d2ebbde5e3f13ab2e25625fd453271d6522e
          - f6920249aa08fc2a2c2e8274ea9648d0bb1e9364
          - 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c
    Semver7:
      title: Semver7
      required:
        - vulnerable
        - vulnerableHashes
      type: object
      properties:
        vulnerable:
          type: array
          items:
            type: string
          description: ''
        vulnerableHashes:
          type: array
          items:
            type: string
          description: ''
      example:
        vulnerable:
          - '>=0'
        vulnerableHashes:
          - '*'
    severity:
      title: severity
      enum:
        - none
        - high
        - medium
        - low
      type: string
      description: The severity assigned to this license
      example: none
    severity1:
      title: severity1
      type: object
      properties:
        critical:
          type: number
          description: The number of critical severity issues
        high:
          type: number
          description: The number of high severity issues
        medium:
          type: number
          description: The number of medium severity issues
        low:
          type: number
          description: The number of low severity issues
    snapshots:
      title: snapshots
      required:
        - id
        - created
        - totalDependencies
        - issueCounts
      type: object
      properties:
        id:
          type: string
          description: The snapshot identifier
        created:
          type: string
          description: The date that the snapshot was taken
          example: 2018-10-29T09:50:54.014Z
        totalDependencies:
          type: number
          description: Number of dependencies of the project
        issueCounts:
          allOf:
            - $ref: '#/components/schemas/issueCounts2'
            - description: Number of known vulnerabilities in the project, not including ignored issues
        imageId:
          type: string
          example: sha256:caf27325b298a6730837023a8a342699c8b7b388b8d878966b064a1320043019
        imageTag:
          type: string
          example: latest
        imageBaseImage:
          type: string
          example: alpine:3
        imagePlatform:
          type: string
          example: linux/arm64
        method:
          allOf:
            - $ref: '#/components/schemas/method'
            - description: The method by which this snapshot was created.
    SNYKJAVACHQOSLOGBACK30208:
      title: SNYKJAVACHQOSLOGBACK30208
      required:
        - CVSSv3
        - credit
        - cvssScore
        - description
        - disclosureTime
        - fixedIn
        - id
        - identifiers
        - language
        - mavenModuleName
        - moduleName
        - packageManager
        - packageName
        - patches
        - semver
        - severity
        - title
      type: object
      properties:
        CVSSv3:
          type: string
        credit:
          type: array
          items:
            type: string
          description: ''
        cvssScore:
          type: number
        description:
          type: string
        disclosureTime:
          type: string
        fixedIn:
          type: array
          items:
            type: string
          description: ''
        id:
          type: string
        identifiers:
          $ref: '#/components/schemas/Identifiers2'
        language:
          type: string
        mavenModuleName:
          $ref: '#/components/schemas/MavenModuleName'
        moduleName:
          type: string
        packageManager:
          type: string
        packageName:
          type: string
        patches:
          type: array
          items:
            type: string
          description: ''
        semver:
          $ref: '#/components/schemas/Semver2'
        severity:
          type: string
        title:
          type: string
      example:
        CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
        credit:
          - Unknown
        cvssScore: 9.8
        description: "## Overview\n\n[ch.qos.logback:logback-core](https://mvnrepository.com/artifact/ch.qos.logback/logback-core) is a logback-core module.\n\n\nAffected versions of this package are vulnerable to Arbitrary Code Execution.\nA configuration can be turned on to allow remote logging through interfaces that accept untrusted serialized data. Authenticated attackers on the adjacent network can exploit this vulnerability to run arbitrary code through the deserialization of custom gadget chains.\n\n## Details\nSerialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.\r\n\r\n  \r\n\r\n_Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.\r\n\r\n  \r\n\r\nJava deserialization issues have been known for years. However, interest in the issue intensified greatly in 2015, when classes that could be abused to achieve remote code execution were found in a [popular library (Apache Commons Collection)](https://snyk.io/vuln/SNYK-JAVA-COMMONSCOLLECTIONS-30078). These classes were used in zero-days affecting IBM WebSphere, Oracle WebLogic and many other products.\r\n\r\n  \r\n\r\nAn attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.\r\n\r\n  \r\n\r\n> Developers put too much trust in Java Object Serialization. Some even de-serialize objects pre-authentication. When deserializing an Object in Java you typically cast it to an expected type, and therefore Java's strict type system will ensure you only get valid object trees. Unfortunately, by the time the type checking happens, platform code has already created and executed significant logic. So, before the final type is checked a lot of code is executed from the readObject() methods of various objects, all of which is out of the developer's control. By combining the readObject() methods of various classes which are available on the classpath of the vulnerable application an attacker can execute functions (including calling Runtime.exec() to execute local OS commands).\r\n\r\n- Apache Blog\r\n\r\n  \r\n\r\nThe vulnerability, also know as _Mad Gadget_\r\n\r\n> Mad Gadget is one of the most pernicious vulnerabilities we’ve seen. By merely existing on the Java classpath, seven “gadget” classes in Apache Commons Collections (versions 3.0, 3.1, 3.2, 3.2.1, and 4.0) make object deserialization for the entire JVM process Turing complete with an exec function. Since many business applications use object deserialization to send messages across the network, it would be like hiring a bank teller who was trained to hand over all the money in the vault if asked to do so politely, and then entrusting that teller with the key. The only thing that would keep a bank safe in such a circumstance is that most people wouldn’t consider asking such a question.\r\n\r\n- Google\n\n## Remediation\n\nUpgrade `ch.qos.logback:logback-core` to version 1.1.11 or higher.\n\n\n## References\n\n- [Logback News](https://logback.qos.ch/news.html)\n\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5929/)\n"
        disclosureTime: 2017-03-13T06:59:00Z
        fixedIn:
          - 1.1.11
        id: SNYK-JAVA-CHQOSLOGBACK-30208
        identifiers:
          CVE:
            - CVE-2017-5929
          CWE:
            - CWE-502
        language: java
        mavenModuleName:
          artifactId: logback-core
          groupId: ch.qos.logback
        moduleName: ch.qos.logback:logback-core
        packageManager: maven
        packageName: ch.qos.logback:logback-core
        patches: []
        semver:
          vulnerable:
            - '[, 1.1.11)'
        severity: critical
        title: Arbitrary Code Execution
    sortBy:
      title: sortBy
      enum:
        - projects
        - dependency
        - severity
        - dependenciesWithIssues
      type: string
    sortBy1:
      title: sortBy1
      enum:
        - license
        - dependencies
        - projects
        - severity
      type: string
    sortBy2:
      title: sortBy2
      enum:
        - severity
        - issueTitle
        - projectName
        - isFixed
        - isPatched
        - isIgnored
        - introducedDate
        - isUpgradable
        - isPatchable
        - priorityScore
      type: string
    source:
      title: source
      enum:
        - cli
        - api
      type: string
      description: The place where the ignore rule was applied from
    tags:
      title: tags
      type: object
      properties:
        includes:
          type: array
          items:
            type: string
          description: A project must have all provided tags in order to be included in the response. A maximum of 3 tags can be supplied.
    target:
      title: target
      type: object
      properties:
        contents:
          type: string
          example: '{\"comment\":\"\",\"ignore\":\"test\",\"package\":[{\"checksumSHA1\":\"o/3cn04KAiwC7NqNVvmfVTD+hgA=\",\"path\":\"github.com/Microsoft/go-winio\",\"revision\":\"78439966b38d69bf38227fbf57ac8a6fee70f69a\",\"revisionTime\":\"2017-08-04T20:09:54Z\"},{\"checksumSHA1\":\"GqIrOttKaO7k6HIaHQLPr3cY7rY=\",\"path\":\"github.com/containerd/continuity/pathdriver\",\"revision\":\"617902de2ab5e18974efd88a58eeef67ac82d127\",\"revisionTime\":\"2017-09-25T16:43:31Z\"},{\"checksumSHA1\":\"ndnAFCfsGC3upNQ6jAEwzxcurww=\",\"path\":\"github.com/docker/docker/pkg/longpath\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"IVWozKA/coqhti24Ss2b1nLrTSg=\",\"path\":\"github.com/docker/docker/pkg/mount\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"YdUAOhhc/C0zu+eYrJOJjDwr1/4=\",\"path\":\"github.com/docker/docker/pkg/symlink\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"UEMAKQqAyL9hs6RWxesQuYMQ3+I=\",\"path\":\"github.com/docker/docker/pkg/system\",\"revision\":\"74a084162ce544fe995715ba47aa84d3d75b95c1\",\"revisionTime\":\"2017-09-26T16:09:50Z\"},{\"checksumSHA1\":\"UmXGieuTJQOzJPspPJTVKKKMiUA=\",\"path\":\"github.com/docker/go-units\",\"revision\":\"0dadbb0345b35ec7ef35e228dabb8de89a65bf52\",\"revisionTime\":\"2017-01-27T09:51:30Z\"},{\"checksumSHA1\":\"RCARG9BoOH6jwbqnuix2Ne3K26w=\",\"path\":\"github.com/docker/libcontainer\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"OVGl5SGmF1HZmaG6JRmkyWiycYA=\",\"path\":\"github.com/docker/libcontainer/cgroups\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"q56oWh80PeIBiE/8nQ/Emz18ZZ8=\",\"path\":\"github.com/docker/libcontainer/cgroups/fs\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"3NQtWwKOT4BlnSWn0tTsy/N+XhU=\",\"path\":\"github.com/docker/libcontainer/console\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"WPIuCuWS1RkrGCHBRZuOJku7ZBc=\",\"path\":\"github.com/docker/libcontainer/devices\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"HLo2E8AWKNCwE2p7ndEkKc4SPnM=\",\"path\":\"github.com/docker/libcontainer/label\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"KYcr4bHkervvLS5wuH9w1+EhflY=\",\"path\":\"github.com/docker/libcontainer/mount\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"tvHnvhbm17pLR/fA2WXWYlY9aDs=\",\"path\":\"github.com/docker/libcontainer/mount/nodes\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"k9+kwIouq8vqmodLrGFp+9I7Jxs=\",\"path\":\"github.com/docker/libcontainer/netlink\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"ndpCrSi/XKZNCCrkjpQ2cgMIxKA=\",\"path\":\"github.com/docker/libcontainer/network\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"cfgnX7wKfSHOJ4mbhKyjAWizl+s=\",\"path\":\"github.com/docker/libcontainer/selinux\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"M7/2WUk1uzgdqc5Ce/k9UcSyv1M=\",\"path\":\"github.com/docker/libcontainer/system\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"2ZMmNaPI3TM4WyMjCw+h1jErSr0=\",\"path\":\"github.com/docker/libcontainer/utils\",\"revision\":\"53eca435e63db58b06cf796d3a9326db5fd42253\",\"revisionTime\":\"2014-12-02T23:28:38Z\",\"version\":\"v1.4\",\"versionExact\":\"v1.4.0\"},{\"checksumSHA1\":\"rJab1YdNhQooDiBWNnt7TLWPyBU=\",\"path\":\"github.com/pkg/errors\",\"revision\":\"2b3a18b5f0fb6b4f9190549597d3f962c02bc5eb\",\"revisionTime\":\"2017-09-10T13:46:14Z\"},{\"checksumSHA1\":\"BYvROBsiyAXK4sq6yhDe8RgT4LM=\",\"path\":\"github.com/sirupsen/logrus\",\"revision\":\"89742aefa4b206dcf400792f3bd35b542998eb3b\",\"revisionTime\":\"2017-08-22T13:27:46Z\"},{\"checksumSHA1\":\"nqWNlnMmVpt628zzvyo6Yv2CX5Q=\",\"path\":\"golang.org/x/crypto/ssh/terminal\",\"revision\":\"847319b7fc94cab682988f93da778204da164588\",\"revisionTime\":\"2017-08-18T09:57:21Z\"},{\"checksumSHA1\":\"uggjqMBFNJd11oNco2kbkAT641w=\",\"path\":\"golang.org/x/sys/unix\",\"revision\":\"429f518978ab01db8bb6f44b66785088e7fba58b\",\"revisionTime\":\"2017-09-20T21:38:28Z\"},{\"checksumSHA1\":\"pBPFzDGt3AVSRffB7ffiUnruFUk=\",\"path\":\"golang.org/x/sys/windows\",\"revision\":\"429f518978ab01db8bb6f44b66785088e7fba58b\",\"revisionTime\":\"2017-09-20T21:38:28Z\"},{\"checksumSHA1\":\"o5NrWoSkC+ugoK9D6ragLSrXHw0=\",\"path\":\"gopkg.in/square/go-jose.v2\",\"revision\":\"296c7f1463ec9b712176dc804dea0173d06dc728\",\"revisionTime\":\"2016-11-17T00:42:38Z\",\"version\":\"v2.0\",\"versionExact\":\"v2.0.1\"},{\"checksumSHA1\":\"j94zYNLTvPSnfnqVKJ4LUf++uX4=\",\"path\":\"gopkg.in/square/go-jose.v2/cipher\",\"revision\":\"296c7f1463ec9b712176dc804dea0173d06dc728\",\"revisionTime\":\"2016-11-17T00:42:38Z\",\"version\":\"v2.0\",\"versionExact\":\"v2.0.1\"},{\"checksumSHA1\":\"JFun0lWY9eqd80Js2iWsehu1gc4=\",\"path\":\"gopkg.in/square/go-jose.v2/json\",\"revision\":\"296c7f1463ec9b712176dc804dea0173d06dc728\",\"revisionTime\":\"2016-11-17T00:42:38Z\",\"version\":\"v2.0\",\"versionExact\":\"v2.0.1\"}],\"rootPath\":\"with-vuln\"}'
      description: the `vendor.json` file, encoded according the the "encoding" field.
    target1:
      title: target1
      type: object
      properties:
        contents:
          type: string
          example: '"# Gopkg.toml example\r\n#\r\n# Refer to https://golang.github.io/dep/docs/Gopkg.toml.html\r\n# for detailed Gopkg.toml documentation.\r\n#\r\n# required = [\"github.com/user/thing/cmd/thing\"]\r\n# ignored = [\"github.com/user/project/pkgX\", \"bitbucket.org/user/project/pkgA/pkgY\"]\r\n#\r\n# [[constraint]]\r\n#   name = \"github.com/user/project\"\r\n#   version = \"1.0.0\"\r\n#\r\n# [[constraint]]\r\n#   name = \"github.com/user/project2\"\r\n#   branch = \"dev\"\r\n#   source = \"github.com/myfork/project2\"\r\n#\r\n# [[override]]\r\n#   name = \"github.com/x/y\"\r\n#   version = \"2.4.0\"\r\n#\r\n# [prune]\r\n#   non-go = false\r\n#   go-tests = true\r\n#   unused-packages = true\r\n\r\n\r\n[[constraint]]\r\n  branch = \"master\"\r\n  name = \"github.com/asaskevich/EventBus\"\r\n\r\n[[constraint]]\r\n  branch = \"master\"\r\n  name = \"github.com/cloudevents/sdk-go\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/gin-gonic/gin\"\r\n  version = \"1.3.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/golang/protobuf\"\r\n  version = \"1.2.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/goph/emperror\"\r\n  version = \"0.14.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/goph/logur\"\r\n  version = \"0.5.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/patrickmn/go-cache\"\r\n  version = \"2.1.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/pkg/errors\"\r\n  version = \"0.8.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/satori/go.uuid\"\r\n  version = \"1.2.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/sirupsen/logrus\"\r\n  version = \"1.2.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/spf13/cast\"\r\n  version = \"1.3.0\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/spf13/pflag\"\r\n  version = \"1.0.3\"\r\n\r\n[[constraint]]\r\n  name = \"github.com/spf13/viper\"\r\n  version = \"1.3.1\"\r\n\r\n[[constraint]]\r\n  branch = \"master\"\r\n  name = \"golang.org/x/net\"\r\n\r\n[[constraint]]\r\n  name = \"google.golang.org/grpc\"\r\n  version = \"1.17.0\"\r\n\r\n[[constraint]]\r\n  name = \"gopkg.in/go-playground/validator.v8\"\r\n  version = \"8.18.2\"\r\n\r\n[[constraint]]\r\n  name = \"gopkg.in/yaml.v2\"\r\n  version = \"2.2.2\"\r\n\r\n[prune]\r\n  go-tests = true\r\n  unused-packages = true"'
      description: the `Gopkg.toml` file, encoded according the the "encoding" field.
    target2:
      title: target2
      required:
        - contents
      type: object
      properties:
        contents:
          type: string
          description: the contents of `package.json` as a string.
          example: eyAibmFtZSI6ICJzaGFsbG93LWdvb2YiLCAidmVyc2lvbiI6ICIwLjAuMSIsICJkZXNjcmlwdGlvbiI6ICJBIHZ1bG5lcmFibGUgZGVtbyBhcHBsaWNhdGlvbiIsICJob21lcGFnZSI6ICJodHRwczovL3NueWsuaW8vIiwgInJlcG9zaXRvcnkiOiB7ICJ0eXBlIjogImdpdCIsICJ1cmwiOiAiaHR0cHM6Ly9naXRodWIuY29tL1NueWsvc2hhbGxvdy1nb29mIiB9LCAiZGVwZW5kZW5jaWVzIjogeyAibm9kZS11dWlkIjogIjEuNC4wIiwgInFzIjogIjAuMC42IiB9IH0K
      description: the `package.json` file, encoded according the the "encoding" field.
    target4:
      title: target4
      required:
        - contents
      type: object
      properties:
        contents:
          type: string
          description: the contents of `Gemfile.lock` as a string.
          example: 'GEM\n remote: http://rubygems.org/\n specs:\n actionpack (4.2.5)\n actionview (= 4.2.5)\n activesupport (= 4.2.5)\n rack (~> 1.6)\n rack-test (~> 0.6.2)\n rails-dom-testing (~> 1.0, >= 1.0.5)\n rails-html-sanitizer (~> 1.0, >= 1.0.2)\n actionview (4.2.5)\n activesupport (= 4.2.5)\n builder (~> 3.1)\n erubis (~> 2.7.0)\n rails-dom-testing (~> 1.0, >= 1.0.5)\n rails-html-sanitizer (~> 1.0, >= 1.0.2)\n activesupport (4.2.5)\n i18n (~> 0.7)\n json (~> 1.7, >= 1.7.7)\n minitest (~> 5.1)\n thread_safe (~> 0.3, >= 0.3.4)\n tzinfo (~> 1.1)\n builder (3.2.2)\n erubis (2.7.0)\n haml (3.1.4)\n httparty (0.8.1)\n multi_json\n multi_xml\n i18n (0.7.0)\n json (1.8.3)\n loofah (2.0.3)\n nokogiri (>= 1.5.9)\n mini_portile2 (2.1.0)\n minitest (5.9.1)\n multi_json (1.12.1)\n multi_xml (0.5.5)\n nokogiri (1.6.8.1)\n mini_portile2 (~> 2.1.0)\n rack (1.6.4)\n rack-protection (1.5.3)\n rack\n rack-test (0.6.3)\n rack (>= 1.0)\n rails-deprecated_sanitizer (1.0.3)\n activesupport (>= 4.2.0.alpha)\n rails-dom-testing (1.0.7)\n activesupport (>= 4.2.0.beta, < 5.0)\n nokogiri (~> 1.6.0)\n rails-deprecated_sanitizer (>= 1.0.1)\n rails-html-sanitizer (1.0.3)\n loofah (~> 2.0)\n sinatra (1.3.2)\n rack (~> 1.3, >= 1.3.6)\n rack-protection (~> 1.2)\n tilt (~> 1.3, >= 1.3.3)\n thread_safe (0.3.5)\n tilt (1.4.1)\n tzinfo (1.2.2)\n thread_safe (~> 0.1)\n \n PLATFORMS\n ruby\n \n DEPENDENCIES\n actionpack\n haml\n httparty\n sinatra\n \n BUNDLED WITH\n 1.13.2'
      description: the `Gemfile.lock` file, encoded according the the "encoding" field.
    target5:
      title: target5
      required:
        - contents
      type: object
      properties:
        contents:
          type: string
          description: the contents of `requirements.txt` as a string, encoded according to `encoding` above.
          example: supervisor==3.1\noauth2==1.5.211
      description: the `requirements.txt` file, encoded according the the "encoding" field.
    target6:
      title: target6
      type: object
      properties:
        contents:
          type: string
          example: ''
      description: the `composer.json` file, encoded according the the "encoding" field.
    GithubAndGithubEnterpriseRepoTarget:
      title: GithubAndGithubEnterpriseRepoTarget
      required:
        - owner
        - name
        - branch
      type: object
      properties:
        owner:
          type: string
          description: account owner of the repository
          example: org-security
        name:
          type: string
          description: name of the repo
          example: goof
        branch:
          type: string
          description: default branch of the repo (Please contact support if you want to import a non default repo branch)
          example: main
    AzureReposTarget:
      title: AzureReposTarget
      required:
        - owner
        - name
        - branch
      type: object
      properties:
        owner:
          type: string
          description: name of the project containing the repo
          example: my-project
        name:
          type: string
          description: name of the repo
          example: goof
        branch:
          type: string
          description: default branch of the repo (Please contact support if you want to import a non default repo branch)
          example: main
    GitLabRepoTarget:
      title: GitLabRepoTarget
      required:
        - id
        - branch
      type: object
      properties:
        id:
          type: number
          description: id of the repo
          example: 11
        branch:
          type: string
          description: repo branch
          example: develop
    BitbucketCloudTarget:
      title: BitbucketCloudTarget
      required:
        - owner
        - name
      type: object
      properties:
        owner:
          type: string
          description: this is the `Workspace ID`
          example: org-security
        name:
          type: string
          description: name of the repo
          example: goof
    BitbucketServerTarget:
      title: BitbucketServerTarget
      required:
        - projectKey
        - repoSlug
      type: object
      properties:
        projectKey:
          type: string
          description: project key
          example: SNYK_REPOS
        repoSlug:
          type: string
          description: slug of the repo
          example: test
        name:
          type: string
          description: custom name for the project
        branch:
          type: string
          description: target branch name
    HerokuTarget:
      title: HerokuTarget
      required:
        - appId
        - slugId
      type: object
      properties:
        appId:
          type: string
          description: ID of the app
        slugId:
          type: string
          description: ID of the slug
    AWSLambdaTarget:
      title: AWSLambdaTarget
      required:
        - functionId
      type: object
      properties:
        functionId:
          type: string
          description: ID of the app
    CloudFoundryPivotalIBMCloudTarget:
      title: CloudFoundryPivotalIBMCloudTarget
      required:
        - appId
      type: object
      properties:
        appId:
          type: string
          description: ID of the app
    DockerHubTarget:
      title: DockerHubTarget
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: image name including tag prefixed by organization name
          example: organization/repository:tag
    AzureContainerRegistryElasticContainerRegistryArifactoryContainerRegistryNexusTarget:
      title: AzureContainerRegistryElasticContainerRegistryArifactoryContainerRegistryNexusTarget
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: image name including tag
          example: repository:tag
    GoogleCRGoogleARHarborDigitalOceanCRQuayGitlabCRGithubCR:
      title: GoogleCRGoogleARHarborDigitalOceanCRQuayGitlabCRGithubCR
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: image name including tag prefixed by project id or project name
          example: project/repository:tag
    Testcomposer.jsoncomposer.lockfileresponse:
      title: Testcomposer.jsoncomposer.lockfileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues1'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
      example:
        ok: false
        issues:
          vulnerabilities:
            - id: SNYK-PHP-AWSAWSSDKPHP-70003
              url: https://snyk.io/vuln/SNYK-PHP-AWSAWSSDKPHP-70003
              title: Arbitrary Code Execution
              type: vuln
              description: >
                ## Overview
                  Affected versions of [`aws/aws-sdk-php`](https://packagist.org/packages/aws/aws-sdk-php) are vulnerable to Arbitrary Code Execution.

                Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.


                ## Remediation

                Upgrade `aws/aws-sdk-php` to version 3.2.1 or higher.


                ## References

                - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-5723)

                - [Github ChangeLog](https://github.com/aws/aws-sdk-php/blob/master/CHANGELOG.md#321---2015-07-23)
              functions: []
              from:
                - aws/aws-sdk-php@3.0.0
              package: aws/aws-sdk-php
              version: 3.0.0
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <3.2.1
              publicationTime: 2015-07-24T00:41:41Z
              disclosureTime: 2015-07-24T00:41:41Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-5723
                CWE:
                  - CWE-264
              credit:
                - Ryan Lane
              CVSSv3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
              cvssScore: 7.8
              patches: []
              upgradePath: []
            - id: SNYK-PHP-DOCTRINECOMMON-70024
              url: https://snyk.io/vuln/SNYK-PHP-DOCTRINECOMMON-70024
              title: Arbitrary Code Execution
              type: vuln
              description: >
                ## Overview

                Affected versions of [`doctrine/common`](https://packagist.org/packages/doctrine/common) are vulnerable to Arbitrary Code Execution.


                Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.


                ## Remediation

                Upgrade `doctrine/common` to version 2.5.1, 2.4.3 or higher.


                ## References

                - [Doctrine Release Notes](http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html)
              functions: []
              from:
                - doctrine/common@2.5.0
              package: doctrine/common
              version: 2.5.0
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.4.3
                  - '>=2.5.0, <2.5.1'
              publicationTime: 2015-08-31T14:42:59Z
              disclosureTime: 2015-08-31T14:42:59Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-5723
                CWE:
                  - CWE-94
              credit:
                - Ryan Lane
              CVSSv3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
              cvssScore: 7.8
              patches: []
              upgradePath: []
            - id: SNYK-PHP-DOCTRINECOMMON-70024
              url: https://snyk.io/vuln/SNYK-PHP-DOCTRINECOMMON-70024
              title: Arbitrary Code Execution
              type: vuln
              description: >
                ## Overview

                Affected versions of [`doctrine/common`](https://packagist.org/packages/doctrine/common) are vulnerable to Arbitrary Code Execution.


                Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local users to execute arbitrary PHP code with additional privileges by leveraging an application with the umask set to 0 and that executes cache entries as code.


                ## Remediation

                Upgrade `doctrine/common` to version 2.5.1, 2.4.3 or higher.


                ## References

                - [Doctrine Release Notes](http://www.doctrine-project.org/2015/08/31/security_misconfiguration_vulnerability_in_various_doctrine_projects.html)
              functions: []
              from:
                - symfony/symfony@2.3.1
                - doctrine/common@2.5.0
              package: doctrine/common
              version: 2.5.0
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.4.3
                  - '>=2.5.0, <2.5.1'
              publicationTime: 2015-08-31T14:42:59Z
              disclosureTime: 2015-08-31T14:42:59Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-5723
                CWE:
                  - CWE-94
              credit:
                - Ryan Lane
              CVSSv3: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
              cvssScore: 7.8
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-173743
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-173743
              title: Cross-site Scripting (XSS)
              type: vuln
              description: "## Overview\n\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a PHP framework for web applications and a set of reusable PHP components.\n\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS).\nA remote attacker could inject arbitrary web script or HTML via the \"file\" parameter in a URL.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\n\nUpgrade `symfony/symfony` to version 4.1 or higher.\n\n\n## References\n\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-12040)\n"
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <4.1
              publicationTime: 2018-06-14T00:35:49Z
              disclosureTime: 2018-06-08T00:35:49Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-12040
                CWE:
                  - CWE-79
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
              cvssScore: 6.1
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-173744
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-173744
              title: Host Header Injection
              type: vuln
              description: >
                ## Overview


                [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a PHP framework for web applications and a set of reusable PHP components.



                Affected versions of this package are vulnerable to Host Header Injection.

                When using `HttpCache`, the values of the `X-Forwarded-Host` headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.


                ## Remediation


                Upgrade `symfony/symfony` to version 2.7.49, 2.8.44, 3.3.18, 3.4.14, 4.0.14, 4.1.2 or higher.



                ## References


                - [GitHub Commit](https://github.com/symfony/symfony/commit/725dee4cd8b4ccd52e335ae4b4522242cea9bd4a)


                - [GitHub Release Tag 4.1.3](https://github.com/symfony/symfony/releases/tag/v4.1.3)


                - [Symphony Security Blog](https://symfony.com/blog/cve-2018-14774-possible-host-header-injection-when-using-httpcache)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.7.49
                  - '>=2.8.0, <2.8.44'
                  - '>=3.3.0, <3.3.18'
                  - '>=3.4.0, <3.4.14'
                  - '>=4.0.0, <4.0.14'
                  - '>=4.1.0, <4.1.2'
              publicationTime: 2018-08-05T13:44:27Z
              disclosureTime: 2018-07-31T17:24:43Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-14774
                CWE:
                  - CWE-444
              credit:
                - Chaosversum
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
              cvssScore: 7.2
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-173745
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-173745
              title: Cross-site Scripting (XSS)
              type: vuln
              description: "## Overview\n\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is a PHP framework for web applications and a set of reusable PHP components.\n\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS)\nvia the content page.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n## Remediation\n\nUpgrade `symfony/symfony` to version 2.7.7 or higher.\n\n\n## References\n\n- [GitHub Commit](https://github.com/symphonycms/symphony-2/commit/1ace6b31867cc83267b3550686271c9c65ac3ec0)\n\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-12043)\n"
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.7.7
              publicationTime: 2018-06-13T10:56:51Z
              disclosureTime: 2018-06-07T21:05:47Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-12043
                CWE:
                  - CWE-79
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
              cvssScore: 6.1
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70207
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70207
              title: Loss of Information
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Loss of Information.


                When using the Validator component, if Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache is enabled (or any other cache implementing Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface), some information is lost during serialization (the collectionCascaded and the collectionCascadedDeeply fields).


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.3, 2.1.12, 2.2.5, 2.0.24 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: low
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.3'
                  - '>=2.1.0, <2.1.12'
                  - '>=2.2.0, <2.2.5'
                  - '>=2, <2.0.24'
              publicationTime: 2013-08-17T07:55:32Z
              disclosureTime: 2013-08-17T07:55:32Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2013-4751
                CWE:
                  - CWE-221
              credit:
                - Alexandre Salome
              CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 3.7
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70208
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70208
              title: HTTP Host Header Poisoning
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to HTTP Host Header Poisoning.


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.3, 2.1.12, 2.2.5, 2.0.24 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/security-releases-symfony-2-0-24-2-1-12-2-2-5-and-2-3-3-released)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.3'
                  - '>=2.1.0, <2.1.12'
                  - '>=2.2.0, <2.2.5'
                  - '>=2, <2.0.24'
              publicationTime: 2013-08-17T09:14:49Z
              disclosureTime: 2013-08-17T09:14:49Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2013-4752
                CWE:
                  - CWE-74
              credit:
                - Jordan Alliot
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
              cvssScore: 8.2
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70209
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70209
              title: Denial of Service (DoS)
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Denial of Service (DoS).


                The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a similar issue to [CVE-2013-5750](https://snyk.io/vuln/SNYK-PHP-FRIENDSOFSYMFONYUSERBUNDLE-70102).


                ## Details

                Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                Two common types of DoS vulnerabilities:



                * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.6, 2.1.13, 2.2.9, 2.0.25 or higher.


                ## References

                - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-5958)

                - [Symfony Release Notes](http://symfony.com/blog/security-releases-cve-2013-5958-symfony-2-0-25-2-1-13-2-2-9-and-2-3-6-released)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2, <2.0.25'
                  - '>=2.1.0, <2.1.13'
                  - '>=2.2.0, <2.2.9'
                  - '>=2.3.0, <2.3.6'
              publicationTime: 2013-10-10T08:30:51Z
              disclosureTime: 2013-10-10T08:30:51Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2013-5958
                CWE:
                  - CWE-400
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
              cvssScore: 5.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70210
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70210
              title: Arbitrary Code Injection
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Arbitrary Code Injection.


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/security-releases-cve-2014-4931-symfony-2-3-18-2-4-8-and-2-5-2-released)

                - [GitHub Commit](https://github.com/symfony/symfony/commit/06a80fbdbe744ad6f3010479ba64ef5cf35dd9af)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.19'
                  - '>=2.1.0, <2.2.0'
                  - '>=2.4.0, <2.4.9'
                  - '>=2.5.0, <2.5.4'
                  - '>=2.2.0, <2.3.0'
                  - '>=2, <2.1.0'
              publicationTime: 2014-07-25T22:18:02Z
              disclosureTime: 2014-07-25T22:18:02Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2014-4931
                CWE:
                  - CWE-94
              credit:
                - Jeremy Derussé
              CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
              cvssScore: 5.6
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70211
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70211
              title: Denial of Service (DoS)
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Denial of Service (DoS).


                ## Details

                Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                Two common types of DoS vulnerabilities:



                * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.19, 2.4.9, 2.5.4 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2014-5244-denial-of-service-with-a-malicious-http-host-header)

                - [GitHub PR](https://github.com/symfony/symfony/pull/11828)

                - [GitHub Commit](https://github.com/symfony/symfony/commit/1ee96a8b1b0987ffe2a62dca7ad268bf9edfa9b8)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2, <2.3.19'
                  - '>=2.4.0, <2.4.9'
                  - '>=2.5.0, <2.5.4'
              publicationTime: 2014-09-03T07:37:21Z
              disclosureTime: 2014-09-03T07:37:21Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2014-5244
                CWE:
                  - CWE-400
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 5.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70212
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70212
              title: Information Exposure
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Information Exposure.


                When you enable the ESI feature and when you are using a proxy like Varnish that you configured as a trusted proxy, the FragmentHandler considered requests to render fragments as coming from a trusted source, even if the client was requesting them directly. Symfony can not distinguish between ESI requests done on behalf of the client by Varnish and faked fragment requests coming directly from the client.


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2014-5245-direct-access-of-esi-urls-behind-a-trusted-proxy)

                - [GitHub PR](https://github.com/symfony/symfony/pull/11831)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: low
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.19'
                  - '>=2.1.0, <2.2.0'
                  - '>=2.4.0, <2.4.9'
                  - '>=2.5.0, <2.5.4'
                  - '>=2.2.0, <2.3.0'
                  - '>=2, <2.1.0'
              publicationTime: 2014-09-03T07:40:02Z
              disclosureTime: 2014-09-03T07:40:02Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2014-5245
                CWE:
                  - CWE-200
              credit:
                - Cédric Nirousset
                - Trent Steel
                - Christophe Coevoet
              CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 3.7
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70213
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70213
              title: Authentication Bypass
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Authentication Bypass.


                When an application uses an HTTP basic or digest authentication, Symfony does not parse the Authorization header properly, which could be exploited in some server setups (no exploits have been demonstrated though.)


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2014-6061-security-issue-when-parsing-the-authorization-header)

                - [GitHub Issue](https://github.com/symfony/symfony/pull/11829)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: low
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.19'
                  - '>=2.1.0, <2.2.0'
                  - '>=2.4.0, <2.4.9'
                  - '>=2.5.0, <2.5.4'
                  - '>=2.2.0, <2.3.0'
                  - '>=2, <2.1.0'
              publicationTime: 2014-09-03T07:38:23Z
              disclosureTime: 2014-09-03T07:38:23Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2014-6061
                CWE:
                  - CWE-592
              credit:
                - Damien Tournoud
              CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 3.7
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70214
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70214
              title: Cross-site Request Forgery (CSRF)
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Cross-site Request Forgery (CSRF).


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.19, 2.2.0, 2.4.9, 2.5.4, 2.3.0, 2.1.0 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2014-6072-csrf-vulnerability-in-the-web-profiler)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.19'
                  - '>=2.1.0, <2.2.0'
                  - '>=2.4.0, <2.4.9'
                  - '>=2.5.0, <2.5.4'
                  - '>=2.2.0, <2.3.0'
                  - '>=2, <2.1.0'
              publicationTime: 2014-09-03T07:40:30Z
              disclosureTime: 2014-09-03T07:40:30Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2014-6072
                CWE:
                  - CWE-352
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
              cvssScore: 6.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70215
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70215
              title: Arbitrary Code Injection
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Arbitrary Code Injection.


                Eval injection vulnerability in the HttpCache class in HttpKernel in Symfony 2.x before 2.3.27, 2.4.x and 2.5.x before 2.5.11, and 2.6.x before 2.6.6 allows remote attackers to execute arbitrary PHP code via a `language="php"` attribute of a SCRIPT element.


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.27, 2.6.6, 2.2.0, 2.5.0, 2.5.11, 2.3.0, 2.1.0 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2015-2308-esi-code-injection)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.27'
                  - '>=2.6.0, <2.6.6'
                  - '>=2.1.0, <2.2.0'
                  - '>=2.4.0, <2.5.0'
                  - '>=2.5.0, <2.5.11'
                  - '>=2.2.0, <2.3.0'
                  - '>=2, <2.1.0'
              publicationTime: 2015-04-01T18:55:26Z
              disclosureTime: 2015-04-01T18:55:26Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-2308
                CWE:
                  - CWE-94
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
              cvssScore: 6.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70216
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70216
              title: Man-in-the-Middle (MitM)
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Man-in-the-Middle (MitM).


                The `Symfony\Component\HttpFoundation\Request` class provides a mechanism that ensures it does not trust HTTP header values coming from a "non-trusted" client. Unfortunately, it assumes that the remote address is always a trusted client if at least one trusted proxy is involved in the request; this allows a man-in-the-middle attack between the latest trusted proxy and the web server.


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.27, 2.5.11, 2.6.6 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2015-2309-unsafe-methods-in-the-request-class)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2, <2.3.27'
                  - '>=2.4.0, <2.5.11'
                  - '>=2.6.0, <2.6.6'
              publicationTime: 2015-04-01T18:55:26Z
              disclosureTime: 2015-04-01T18:55:26Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-2309
                CWE:
                  - CWE-300
              credit:
                - Dmitrii Chekaliuk
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
              cvssScore: 6.5
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70218
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70218
              title: Session Fixation
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Session Fixation.


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.35, 2.6.12, 2.5.0, 2.7.7, 2.6.0 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2015-8124-session-fixation-in-the-remember-me-login-feature)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.35'
                  - '>=2.6.0, <2.6.12'
                  - '>=2.4.0, <2.5.0'
                  - '>=2.7.0, <2.7.7'
                  - '>=2.5.0, <2.6.0'
              publicationTime: 2015-11-23T11:45:06Z
              disclosureTime: 2015-11-23T11:45:06Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-8124
                CWE:
                  - CWE-384
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
              cvssScore: 6.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70219
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70219
              title: Timing Attack
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Timing Attack.


                Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving:

                * Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices or

                * Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener class in the Symfony Security Component, or

                * legacy CSRF implementation from the Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider class in the Symfony Form component.


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.35, 2.6.12, 2.5.0, 2.7.7, 2.6.0 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2015-8125-potential-remote-timing-attack-vulnerability-in-security-remember-me-service)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.35'
                  - '>=2.6.0, <2.6.12'
                  - '>=2.4.0, <2.5.0'
                  - '>=2.7.0, <2.7.7'
                  - '>=2.5.0, <2.6.0'
              publicationTime: 2015-11-23T11:45:06Z
              disclosureTime: 2015-11-23T11:45:06Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-8125
                CWE:
                  - CWE-208
              credit:
                - Sebastiaan Stok
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
              cvssScore: 7.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70220
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70220
              title: Insecure Randomness
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Insecure Randomness .


                The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.37, 2.6.13, 2.5.0, 2.7.9, 2.6.0 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.37'
                  - '>=2.6.0, <2.6.13'
                  - '>=2.4.0, <2.5.0'
                  - '>=2.7.0, <2.7.9'
                  - '>=2.5.0, <2.6.0'
              publicationTime: 2016-01-14T09:59:32Z
              disclosureTime: 2016-01-14T09:59:32Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2016-1902
                CWE:
                  - CWE-330
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
              cvssScore: 7.5
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-70222
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70222
              title: Denial of Service (DoS)
              type: vuln
              description: >
                ## Overview

                Affected versions of [`symfony/symfony`](https://packagist.org/packages/symfony/symfony) are vulnerable to Denial of Service (DoS).


                The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3.41, 2.7.x before 2.7.13, 2.8.x before 2.8.6, and 3.0.x before 3.0.6 does not limit the length of a username stored in a session, which allows remote attackers to cause a denial of service (session storage consumption) via a series of authentication attempts with long, non-existent usernames.


                ## Details

                Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                Two common types of DoS vulnerabilities:



                * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                ## Remediation

                Upgrade `symfony/symfony` to version 2.3.41, 2.7.0, 2.5.0, 2.7.13, 2.6.0, 2.8.6, 3.0.6 or higher.


                ## References

                - [Symfony Release Notes](http://symfony.com/blog/cve-2016-4423-large-username-storage-in-session)

                - [GitHub PR](https://github.com/symfony/symfony/pull/18733)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.41'
                  - '>=2.6.0, <2.7.0'
                  - '>=2.4.0, <2.5.0'
                  - '>=2.7.0, <2.7.13'
                  - '>=2.5.0, <2.6.0'
                  - '>=2.8.0, <2.8.6'
                  - '>=3, <3.0.6'
              publicationTime: 2016-05-09T21:31:02Z
              disclosureTime: 2016-05-09T21:31:02Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2016-4423
                CWE:
                  - CWE-400
              credit:
                - Marek Alaksa
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
              cvssScore: 7.5
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-72196
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72196
              title: Denial of Service (DoS)
              type: vuln
              description: >
                ## Overview

                [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.


                Affected versions of this package are vulnerable to Denial of Service (DoS) attacks via the `PDOSessionHandler` class.


                **An application is vulnerable when:**


                * It uses `PDOSessionHandler` to store its sessions

                * And it uses MySQL as a backend for sessions managed by `PDOSessionHandler`

                * And the SQL mode does not contain `STRICT_ALL_TABLES` or `STRICT_TRANS_TABLES`.


                With this configuration, An attacker may conduct a denial of service by a well-crafted session, which leads to an infinite loop in the code.


                ## Details

                Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                Two common types of DoS vulnerabilities:



                * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                ## Remediation

                Upgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.


                ## References

                - [Symphony Security Advisory](https://symfony.com/cve-2018-11386)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.7.48
                  - '>=2.8.0, <2.8.41'
                  - '>=3.0.0, <3.3.17'
                  - '>=3.4.0, <3.4.11'
                  - '>=4.0.0, <4.0.11'
              publicationTime: 2018-05-30T11:36:38.154000Z
              disclosureTime: 2018-05-30T03:25:45.531000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-11386
                CWE:
                  - CWE-835
              credit:
                - Federico Stange
              CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
              cvssScore: 5.9
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-72197
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72197
              title: Access Restriction Bypass
              type: vuln
              description: >
                ## Overview

                [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of PHP components.


                Affected versions of this package are vulnerable to Access Restriction Bypass. A misconfigured LDAP server allowed unauthorized access, due to a missing check for `null` passwords.


                **Note:** This is related to [CVE-2016-2403](https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70221).


                ## Remediation

                Upgrade `symfony/symfony` to versions 2.8.37, 3.3.17, 3.4.7, 4.0.7 or higher.


                ## References

                - [Symphony Security Advisory](https://symfony.com/cve-2018-11407)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: critical
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.8.37
                  - '>=3.0.0, <3.3.17'
                  - '>=3.4.0, <3.4.7'
                  - '>=4.0.0, <4.0.7'
              publicationTime: 2018-05-30T11:36:38.236000Z
              disclosureTime: 2018-05-30T03:25:45.532000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-11407
                CWE:
                  - CWE-284
              credit:
                - Theo Bouge
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
              cvssScore: 9.8
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-72198
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72198
              title: CSRF Token Fixation
              type: vuln
              description: >
                ## Overview

                [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.


                Affected versions of this package are vulnerable to CSRF Token Fixation. CSRF tokens where not erased during logout, when the `invalidate_session` option was disabled. By default, a user’s session is invalidated when the user is logged out.


                ## Remediation

                Upgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.


                ## References

                - [Symphony Security Advisory](https://symfony.com/cve-2018-11406)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.7.48
                  - '>=2.8.0, <2.8.41'
                  - '>=3.0.0, <3.3.17'
                  - '>=3.4.0, <3.4.11'
                  - '>=4.0.0, <4.0.11'
              publicationTime: 2018-05-30T11:36:38.318000Z
              disclosureTime: 2018-05-30T03:25:45.533000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-11406
                CWE:
                  - CWE-384
              credit:
                - Kevin Liagre
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
              cvssScore: 8.8
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-72199
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72199
              title: Open Redirect
              type: vuln
              description: >
                ## Overview

                [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.


                Affected versions of this package are vulnerable to Open Redirect. This is due to an incomplete fix for [CVE-2017-16652](https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-70381). There was an an edge case when the `security.http_utils` was inlined by the container.


                ## Remediation

                Upgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.


                ## References

                - [Symphony Security Advisory](https://symfony.com/cve-2018-11408)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.7.48
                  - '>=2.8.0, <2.8.41'
                  - '>=3.0.0, <3.3.17'
                  - '>=3.4.0, <3.4.11'
                  - '>=4.0.0, <4.0.11'
              publicationTime: 2018-05-30T11:36:38.403000Z
              disclosureTime: 2018-05-30T03:25:45.535000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-11408
                CWE:
                  - CWE-601
              credit:
                - Antal Aron
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
              cvssScore: 6.1
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-72200
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72200
              title: Session Fixation
              type: vuln
              description: >
                ## Overview

                [symfony/symfony](https://packagist.org/packages/symfony/symfony) is a set of reusable PHP components.


                Affected versions of this package are vulnerable to Session Fixation via the `Guard` login feature. An attacker may be able to impersonate the victim towards the web application if the session id value was previously known to the attacker. This allows the attacker to access a Symfony web application with the attacked user's permissions.


                **Note:**

                * The `Guard authentication` login feature must be enabled for the attack to be applicable.

                * The attacker must have access to the `PHPSESSID` cookie value or has successfully set a new value in the user's browser.


                ## Remediation

                Upgrade `symfony/symfony` to versions 2.7.48, 2.8.41, 3.3.17, 3.4.11, 4.0.11 or higher.


                ## References

                - [Symphony Security Advisory](https://symfony.com/cve-2018-11385)
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.7.48
                  - '>=2.8.0, <2.8.41'
                  - '>=3.0.0, <3.3.17'
                  - '>=3.4.0, <3.4.11'
                  - '>=4.0.0, <4.0.11'
              publicationTime: 2018-05-30T11:36:38.526000Z
              disclosureTime: 2018-05-30T03:25:45.536000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-11385
                CWE:
                  - CWE-384
              credit:
                - Chris Wilkinson
              CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
              cvssScore: 8.1
              patches: []
              upgradePath: []
            - id: SNYK-PHP-SYMFONYSYMFONY-72246
              url: https://snyk.io/vuln/SNYK-PHP-SYMFONYSYMFONY-72246
              title: Cross-site Scripting (XSS)
              type: vuln
              description: "## Overview\n[symfony/symfony](https://packagist.org/packages/symfony/symfony) is the The Symfony PHP framework.\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks via the `ExceptionHandler.php` method.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `symfony/symfony` to versions 2.7.33, 2.8.26, 3.2.13, 3.3.6 or higher.\n\n## References\n- [GitHub PR](https://github.com/symfony/symfony/pull/23684)\n- [GitHub Issue](https://github.com/symfony/symfony/issues/27987)\n"
              functions: []
              from:
                - symfony/symfony@2.3.1
              package: symfony/symfony
              version: 2.3.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.7.33
                  - '>=2.8.0, <2.8.26'
                  - '>=3.0.0, <3.2.13'
                  - '>=3.3.0, <3.3.6'
              publicationTime: 2018-07-30T13:57:42.005000Z
              disclosureTime: 2018-07-20T00:54:33.251000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2017-18343
                CWE:
                  - CWE-79
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
              cvssScore: 6.1
              patches: []
              upgradePath: []
            - id: SNYK-PHP-TWIGTWIG-173776
              url: https://snyk.io/vuln/SNYK-PHP-TWIGTWIG-173776
              title: Information Exposure
              type: vuln
              description: >
                ## Overview


                [twig/twig](https://packagist.org/packages/twig/twig) is a flexible, fast, and secure template language for PHP.



                Affected versions of this package are vulnerable to Information Exposure

                due to allowing the evaluation of non-trusted templates in a sandbox, where everything is forbidden if not explicitly allowed by a sandbox policy (tags, filters, functions, method calls, ...).



                *Note: If you are not using the sandbox, your code is not affected.*


                ## Remediation


                Upgrade `twig/twig` to version 1.38.0, 2.7.0 or higher.



                ## References


                - [GitHub Commit](https://github.com/twigphp/Twig/commit/0f3af98ef6e71929ad67fb6e5f3ad65777c1c4c5)


                - [Twig Security Advisory](https://symfony.com/blog/twig-sandbox-information-disclosure)
              functions: []
              from:
                - symfony/symfony@2.3.1
                - twig/twig@1.35.0
              package: twig/twig
              version: 1.35.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=1.0.0, <1.38.0'
                  - '>=2.0.0, <2.7.0'
              publicationTime: 2019-03-12T13:58:49Z
              disclosureTime: 2019-03-12T13:58:49Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2019-9942
                CWE:
                  - CWE-200
              credit:
                - Fabien Potencier
              CVSSv3: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N/RL:O
              cvssScore: 4.8
              patches: []
              upgradePath: []
            - id: SNYK-PHP-TWIGTWIG-72239
              url: https://snyk.io/vuln/SNYK-PHP-TWIGTWIG-72239
              title: Server Side Template Injection (SSTI)
              type: vuln
              description: >
                ## Overview

                [twig/twig](https://packagist.org/packages/twig/twig) is a flexible, fast, and secure template language for PHP.


                Affected versions of this package are vulnerable to Server Side Template Injection (SSTI) via the `search_key` parameter.


                ## Remediation

                Upgrade `twig/twig` to version 2.4.4 or higher.


                ## References

                - [Exploit-DB](https://www.exploit-db.com/exploits/44102/)

                - [GitHub Commit](https://github.com/twigphp/Twig/commit/eddb97148ad779f27e670e1e3f19fb323aedafeb)

                - [GitHub ChangLog](https://github.com/twigphp/Twig/blob/2.x/CHANGELOG)
              functions: []
              from:
                - symfony/symfony@2.3.1
                - twig/twig@1.35.0
              package: twig/twig
              version: 1.35.0
              severity: critical
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.4.4
              publicationTime: 2018-07-23T13:46:08.115000Z
              disclosureTime: 2018-07-10T15:06:02.373000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-13818
                CWE:
                  - CWE-94
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
              cvssScore: 9.8
              patches: []
              upgradePath: []
            - id: SNYK-PHP-YIISOFTYII-70295
              url: https://snyk.io/vuln/SNYK-PHP-YIISOFTYII-70295
              title: Arbitrary Code Execution
              type: vuln
              description: >
                ## Overview

                Affected versions of [`yiisoft/yii`](https://packagist.org/packages/yiisoft/yii) are vulnerable to Arbitrary Code Execution.


                The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property.


                ## Remediation

                Upgrade `yiisoft/yii` to version 1.1.15 or higher.


                ## References

                - [Yii Framework Security Advisory](http://www.yiiframework.com/news/78/yii-1-1-15-is-released-security-fix/)
              functions: []
              from:
                - yiisoft/yii@1.1.14
              package: yiisoft/yii
              version: 1.1.14
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <1.1.15
              publicationTime: 2014-06-30T07:15:00Z
              disclosureTime: 2014-06-30T07:15:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2014-4672
                CWE:
                  - CWE-94
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
              cvssScore: 7.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70321
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70321
              title: Route Parameter Injection
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Route Parameter Injection.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.1.4, 2.0.8 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-01)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.1.0, <2.1.4'
                  - '>=2, <2.0.8'
              publicationTime: 2013-03-13T08:39:38Z
              disclosureTime: 2013-03-13T08:39:38Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-74
              credit:
                - codemagician
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
              cvssScore: 6.5
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70322
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70322
              title: Information Exposure
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Information Exposure.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.1.4, 2.0.8 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-02)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: low
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.1.0, <2.1.4'
                  - '>=2, <2.0.8'
              publicationTime: 2013-03-13T15:05:23Z
              disclosureTime: 2013-03-13T15:05:23Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-200
              credit:
                - Pádraic Brady
              CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 3.7
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70323
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70323
              title: SQL Injection
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to SQL Injection due to execution of platform-specific SQL containing interpolations.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.1.4, 2.0.8 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-03)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.1.0, <2.1.4'
                  - '>=2, <2.0.8'
              publicationTime: 2013-03-13T15:04:50Z
              disclosureTime: 2013-03-13T15:04:50Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-89
              credit:
                - Axel Helmert
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
              cvssScore: 6.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70324
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70324
              title: IP Spoofing
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Potential IP Spoofing.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.2.5 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2013-04)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.2.5
              publicationTime: 2013-10-31T10:35:17Z
              disclosureTime: 2013-10-31T10:35:17Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-290
              credit:
                - Steve Talbot
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
              cvssScore: 5.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70325
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70325
              title: XML External Entity (XXE) Injection
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to XML External Entity (XXE) Injection.


                ## Details


                XXE Injection is a type of attack against an application that parses XML input.

                XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.



                Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.



                For example, below is a sample XML document, containing an XML element- username.



                ```xml

                <?xml version="1.0" encoding="ISO-8859-1"?>

                   <username>John</username>

                </xml>

                ```



                An external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.



                ```xml

                <?xml version="1.0" encoding="ISO-8859-1"?>

                <!DOCTYPE foo [

                   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>

                   <username>&xxe;</username>

                </xml>

                ```



                Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.1.6, 2.2.6 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-01)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.1.0, <2.1.6'
                  - '>=2.2.0, <2.2.6'
              publicationTime: 2014-02-26T16:02:02Z
              disclosureTime: 2014-02-26T16:02:02Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-611
              credit:
                - Lukas Reschke
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
              cvssScore: 7.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70326
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70326
              title: Cross-site Scripting (XSS)
              type: vuln
              description: "## Overview\nAffected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Cross-site Scripting (XSS).\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.3.1, 2.2.7 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-03)\n"
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.1'
                  - '>=2, <2.2.7'
              publicationTime: 2014-02-26T16:02:02Z
              disclosureTime: 2014-02-26T16:02:02Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-79
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
              cvssScore: 6.5
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70327
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70327
              title: Authentication Bypass
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Authentication Bypass.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.3.3, 2.2.8 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-05)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.3'
                  - '>=2, <2.2.8'
              publicationTime: 2014-09-16T22:00:00Z
              disclosureTime: 2014-09-16T22:00:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2014-8088
                CWE:
                  - CWE-592
              credit:
                - Matthew Daley
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
              cvssScore: 5.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70328
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70328
              title: SQL Injection
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to SQL Injection vector when manually quoting values for sqlsrv extension, using null byte.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.3.3, 2.2.8 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2014-06)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.3'
                  - '>=2, <2.2.8'
              publicationTime: 2014-09-16T22:00:00Z
              disclosureTime: 2014-09-16T22:00:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2014-8089
                CWE:
                  - CWE-89
              credit:
                - Jonas Sandström
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
              cvssScore: 6.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70329
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70329
              title: Insufficient Session Validation
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Insufficient Session Validation.


                `Zend\Session` session validators do not work as expected if set prior to the start of a session.


                The implication is that subsequent calls to `Zend\Session\SessionManager#start()` (in later requests, assuming a session was created) will not have any validator metadata attached, which causes any validator metadata to be re-built from scratch, thus marking the session as valid.


                An attacker is thus able to simply ignore session validators such as `RemoteAddr` or `HttpUserAgent`, since the "signature" that these validators check against is not being stored in the session.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.3.4, 2.2.9 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-01)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.4'
                  - '>=2, <2.2.9'
              publicationTime: 2015-01-14T22:00:00Z
              disclosureTime: 2015-01-14T22:00:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-284
              credit:
                - Yuriy Dyachenko
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 5.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70330
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70330
              title: SQL Injection
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to SQL Injection.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.3.5, 2.2.10 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-02)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2.3.0, <2.3.5'
                  - '>=2, <2.2.10'
              publicationTime: 2015-02-18T19:15:09Z
              disclosureTime: 2015-02-18T19:15:09Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-0270
                CWE:
                  - CWE-89
              credit:
                - Grigory Ivanov
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
              cvssScore: 6.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70332
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70332
              title: CRLF Injection
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Potential CRLF injection attacks in mail and HTTP headers.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.3.8, 2.4.1 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-04)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.3.8
                  - '>=2.4.0, <2.4.1'
              publicationTime: 2015-05-07T08:53:42Z
              disclosureTime: 2015-05-07T08:53:42Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-3154
                CWE:
                  - CWE-113
              credit:
                - Filippo Tessarotto
                - Maks3w
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
              cvssScore: 5.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70333
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70333
              title: XML External Entity (XXE) Injection
              type: vuln
              description: >-
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to XML External Entity (XXE) Injection.



                ## Details



                XXE Injection is a type of attack against an application that parses XML input.

                XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. By default, many XML processors allow specification of an external entity, a URI that is dereferenced and evaluated during XML processing. When an XML document is being parsed, the parser can make a request and include the content at the specified URI inside of the XML document.



                Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier.



                For example, below is a sample XML document, containing an XML element- username.



                ```xml

                <?xml version="1.0" encoding="ISO-8859-1"?>

                   <username>John</username>

                </xml>

                ```



                An external XML entity - `xxe`, is defined using a system identifier and present within a DOCTYPE header. These entities can access local or remote content. For example the below code contains an external XML entity that would fetch the content of  `/etc/passwd` and display it to the user rendered by `username`.



                ```xml

                <?xml version="1.0" encoding="ISO-8859-1"?>

                <!DOCTYPE foo [

                   <!ENTITY xxe SYSTEM "file:///etc/passwd" >]>

                   <username>&xxe;</username>

                </xml>

                ```



                Other XXE Injection attacks can access local resources that may not stop returning data, possibly impacting application availability and leading to Denial of Service.



                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.4.6, 2.5.1 or higher.



                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-06)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: proof-of-concept
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.4.6
                  - '>=2.5.0, <2.5.1'
              publicationTime: 2015-08-03T15:13:58Z
              disclosureTime: 2015-08-03T15:13:58Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-5161
                CWE:
                  - CWE-611
              credit:
                - Dawid Golunski
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:R
              cvssScore: 6.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70335
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70335
              title: Information Exposure
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Information Exposure.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.4.9 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-09)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: low
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.4.9
              publicationTime: 2015-11-23T14:30:00Z
              disclosureTime: 2015-11-23T14:30:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-200
              credit:
                - Vincent Herbulot
              CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 3.7
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70336
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70336
              title: Information Exposure
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Information Exposure.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.4.9 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2015-10)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - '>=2, <2.4.9'
              publicationTime: 2015-11-23T14:30:00Z
              disclosureTime: 2015-11-23T14:30:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2015-7503
                CWE:
                  - CWE-200
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
              cvssScore: 7.5
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70337
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-70337
              title: Arbitrary Code Execution
              type: vuln
              description: >
                ## Overview

                Affected versions of [`zendframework/zendframework`](https://packagist.org/packages/zendframework/zendframework) are vulnerable to Arbitrary Code Execution.


                ## Remediation

                Upgrade `zendframework/zendframework` to version 2.4.11 or higher.


                ## References

                - [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2016-04)
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: high
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.4.11
              publicationTime: 2016-12-19T15:29:00Z
              disclosureTime: 2016-12-19T15:29:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-94
              credit:
                - Dawid Golunski
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
              cvssScore: 7.3
              patches: []
              upgradePath: []
            - id: SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-72268
              url: https://snyk.io/vuln/SNYK-PHP-ZENDFRAMEWORKZENDFRAMEWORK-72268
              title: Arbitrary URL Rewrite
              type: vuln
              description: "## Overview\n[zendframework/zendframework](https://packagist.org/packages/zendframework/zendframework) provides functionality for consuming RSS and Atom feeds.\n\nAffected versions of this package are vulnerable to Arbitrary URL Rewrite. The request URI marshaling process contains logic that inspects HTTP request headers that are specific to a given server-side URL rewrite mechanism. \n\nWhen these headers are present on systems not running the specific URL rewriting mechanism, the URLs are subject to rewriting, allowing a malicious client or proxy to emulate the headers to request arbitrary content.\n\n## Remediation\nUpgrade `zendframework/zendframework` to version 2.5.0 or higher.\n\n## References\n- [Zend Framework Security Advisory](https://framework.zend.com/security/advisory/ZF2018-01)\n"
              functions: []
              from:
                - zendframework/zendframework@2.1.0
              package: zendframework/zendframework
              version: 2.1.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: php
              packageManager: composer
              semver:
                vulnerable:
                  - <2.5.0
              publicationTime: 2018-08-15T08:34:54.643000Z
              disclosureTime: 2018-08-02T16:29:46.707000Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-601
              credit:
                - Drupal Security Team
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 5.3
              patches: []
              upgradePath: []
          licenses: []
        dependencyCount: 31
        org:
          name: atokeneduser
          id: 4a18d42f-0706-4ad0-b127-24078731fbed
        licensesPolicy: null
        packageManager: composer
    TestDepGraphresponse:
      title: TestDepGraphresponse
      required:
        - ok
        - packageManager
        - issuesData
        - issues
        - org
      type: object
      properties:
        ok:
          type: boolean
        packageManager:
          type: string
        issuesData:
          $ref: '#/components/schemas/IssuesData'
        issues:
          type: array
          items:
            $ref: '#/components/schemas/Issues18'
          description: ''
        org:
          $ref: '#/components/schemas/Org1'
    Testforissuesinapublicgembynameandversionresponse:
      title: Testforissuesinapublicgembynameandversionresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues1'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
      example:
        ok: false
        issues:
          vulnerabilities:
            - id: SNYK-RUBY-RAILSHTMLSANITIZER-22025
              url: https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-22025
              title: Cross-site Scripting (XSS)
              type: vuln
              description: "## Overview\n[rails-html-sanitizer](https://github.com/rails/rails-html-sanitizer)\n\nAffected versions of this package are vulnerable to Cross-site Scripting (XSS). The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, and these attributes can lead to an XSS attack on target applications.\n\nThis issue is similar to [CVE-2018-8048](https://snyk.io/vuln/SNYK-RUBY-LOOFAH-22023) in Loofah.\n\n## Details\nA cross-site scripting attack occurs when the attacker tricks a legitimate web-based application or site to accept a request as originating from a trusted source.\r\n\r\nThis is done by escaping the context of the web application; the web application then delivers that data to its users along with other trusted dynamic content, without validating it. The browser unknowingly executes malicious script on the client side (through client-side languages; usually JavaScript or HTML)  in order to perform actions that are otherwise typically blocked by the browser’s Same Origin Policy.\r\n\r\nֿInjecting malicious code is the most prevalent manner by which XSS is exploited; for this reason, escaping characters in order to prevent this manipulation is the top method for securing code against this vulnerability.\r\n\r\nEscaping means that the application is coded to mark key characters, and particularly key characters included in user input, to prevent those characters from being interpreted in a dangerous context. For example, in HTML, `<` can be coded as  `&lt`; and `>` can be coded as `&gt`; in order to be interpreted and displayed as themselves in text, while within the code itself, they are used for HTML tags. If malicious content is injected into an application that escapes special characters and that malicious content uses `<` and `>` as HTML tags, those characters are nonetheless not interpreted as HTML tags by the browser if they’ve been correctly escaped in the application code and in this way the attempted attack is diverted.\r\n \r\nThe most prominent use of XSS is to steal cookies (source: OWASP HttpOnly) and hijack user sessions, but XSS exploits have been used to expose sensitive information, enable access to privileged services and functionality and deliver malware. \r\n\r\n### Types of attacks\r\nThere are a few methods by which XSS can be manipulated:\r\n\r\n|Type|Origin|Description|\r\n|--|--|--|\r\n|**Stored**|Server|The malicious code is inserted in the application (usually as a link) by the attacker. The code is activated every time a user clicks the link.|\r\n|**Reflected**|Server|The attacker delivers a malicious link externally from the vulnerable web site application to a user. When clicked, malicious code is sent to the vulnerable web site, which reflects the attack back to the user’s browser.| \r\n|**DOM-based**|Client|The attacker forces the user’s browser to render a malicious page. The data in the page itself delivers the cross-site scripting data.|\r\n|**Mutated**| |The attacker injects code that appears safe, but is then rewritten and modified by the browser, while parsing the markup. An example is rebalancing unclosed quotation marks or even adding quotation marks to unquoted parameters.|\r\n\r\n### Affected environments\r\nThe following environments are susceptible to an XSS attack:\r\n\r\n* Web servers\r\n* Application servers\r\n* Web application environments\r\n\r\n### How to prevent\r\nThis section describes the top best practices designed to specifically protect your code: \r\n\r\n* Sanitize data input in an HTTP request before reflecting it back, ensuring all data is validated, filtered or escaped before echoing anything back to the user, such as the values of query parameters during searches. \r\n* Convert special characters such as `?`, `&`, `/`, `<`, `>` and spaces to their respective HTML or URL encoded equivalents. \r\n* Give users the option to disable client-side scripts.\r\n* Redirect invalid requests.\r\n* Detect simultaneous logins, including those from two separate IP addresses, and invalidate those sessions.\r\n* Use and enforce a Content Security Policy (source: Wikipedia) to disable any features that might be manipulated for an XSS attack.\r\n* Read the documentation for any of the libraries referenced in your code to understand which elements allow for embedded HTML.\n\n\n## Remediation\nUpgrade `rails-html-sanitizer` to version 1.0.4 or higher.\n\n## References\n- [Ruby on Rails Security Google Forum](https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ)\n- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2018-3741)\n"
              functions: []
              from:
                - rails-html-sanitizer@1.0.3
              package: rails-html-sanitizer
              version: 1.0.3
              severity: medium
              exploitMaturity: no-known-exploit
              language: ruby
              packageManager: rubygems
              semver:
                vulnerable:
                  - <1.0.4
              publicationTime: 2018-03-27T07:42:10.777000Z
              disclosureTime: 2018-03-22T21:46:15.453000Z
              isUpgradable: true
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-3741
                CWE:
                  - CWE-79
              credit:
                - Kaarlo Haikonen
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
              cvssScore: 6.1
              patches: []
              upgradePath:
                - rails-html-sanitizer@1.0.4
          licenses: []
        dependencyCount: 5
        org:
          name: atokeneduser
          id: 4a18d42f-0706-4ad0-b127-24078731fbed
        licensesPolicy: null
        packageManager: rubygems
    Testforissuesinapublicpackagebygroupidartifactidandversionresponse:
      title: Testforissuesinapublicpackagebygroupidartifactidandversionresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues1'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
    Testforissuesinapublicpackagebygroupnameandversionresponse:
      title: Testforissuesinapublicpackagebygroupnameandversionresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues1'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
    Testforissuesinapublicpackagebynameandversionresponse:
      title: Testforissuesinapublicpackagebynameandversionresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues4'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
      example:
        ok: false
        issues:
          vulnerabilities:
            - id: npm:ms:20151024
              url: https://snyk.io/vuln/npm:ms:20151024
              title: Regular Expression Denial of Service (ReDoS)
              type: vuln
              description: >
                ## Overview


                [ms](https://www.npmjs.com/package/ms) is a tiny millisecond conversion utility.



                Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS)

                attack when converting a time period string (i.e. `"2 days"`, `"1h"`) into a milliseconds integer. A malicious user could pass extremely long strings to `ms()`, causing the server to take a long time to process, subsequently blocking the event loop for that extended period.


                ## Details

                Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.



                The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.



                Let’s take the following regular expression as an example:

                ```js

                regex = /A(B|C+)+D/

                ```



                This regular expression accomplishes the following:

                - `A` The string must start with the letter 'A'

                - `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.

                - `D` Finally, we ensure this section of the string ends with a 'D'



                The expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`



                It most cases, it doesn't take very long for a regex engine to find a match:



                ```bash

                $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'

                0.04s user 0.01s system 95% cpu 0.052 total



                $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'

                1.79s user 0.02s system 99% cpu 1.812 total

                ```



                The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.



                Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.



                Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

                1. CCC

                2. CC+C

                3. C+CC

                4. C+C+C.



                The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.



                From there, the number of steps the engine must use to validate a string just continues to grow.



                | String | Number of C's | Number of steps |

                | -------|-------------:| -----:|

                | ACCCX | 3 | 38

                | ACCCCX | 4 | 71

                | ACCCCCX | 5 | 136

                | ACCCCCCCCCCCCCCX | 14 | 65,553





                By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.


                ## Remediation


                Upgrade `ms` to version 0.7.1 or higher.



                ## References


                - [OSS Security advisory](https://www.openwall.com/lists/oss-security/2016/04/20/11)


                - [OWASP - ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)


                - [Security Focus](https://www.securityfocus.com/bid/96389)
              functions:
                - functionId:
                    filePath: ms.js
                    functionName: parse
                  version:
                    - '>0.1.0 <=0.3.0'
                - functionId:
                    filePath: index.js
                    functionName: parse
                  version:
                    - '>0.3.0 <0.7.1'
              from:
                - ms@0.7.0
              package: ms
              version: 0.7.0
              severity: medium
              exploitMaturity: no-known-exploit
              language: js
              packageManager: npm
              semver:
                vulnerable:
                  - <0.7.1
              publicationTime: 2015-11-06T02:09:36Z
              disclosureTime: 2015-10-24T20:39:59Z
              isUpgradable: true
              isPatchable: true
              isPinnable: false
              identifiers:
                ALTERNATIVE:
                  - SNYK-JS-MS-10064
                CVE:
                  - CVE-2015-8315
                CWE:
                  - CWE-400
                NSP:
                  - 46
              credit:
                - Adam Baldwin
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
              cvssScore: 5.3
              patches:
                - comments: []
                  id: patch:npm:ms:20151024:5
                  modificationTime: 2019-12-03T11:40:45.777474Z
                  urls:
                    - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_5_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk5.patch
                  version: =0.1.0
                - comments: []
                  id: patch:npm:ms:20151024:4
                  modificationTime: 2019-12-03T11:40:45.776329Z
                  urls:
                    - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_4_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk4.patch
                  version: =0.2.0
                - comments: []
                  id: patch:npm:ms:20151024:3
                  modificationTime: 2019-12-03T11:40:45.775292Z
                  urls:
                    - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_3_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk3.patch
                  version: =0.3.0
                - comments: []
                  id: patch:npm:ms:20151024:2
                  modificationTime: 2019-12-03T11:40:45.774221Z
                  urls:
                    - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_2_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk2.patch
                  version: <0.6.0 >0.3.0
                - comments: []
                  id: patch:npm:ms:20151024:1
                  modificationTime: 2019-12-03T11:40:45.773094Z
                  urls:
                    - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_1_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk.patch
                  version: <0.7.0 >=0.6.0
                - comments: []
                  id: patch:npm:ms:20151024:0
                  modificationTime: 2019-12-03T11:40:45.772009Z
                  urls:
                    - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_0_0_48701f029417faf65e6f5e0b61a3cebe5436b07b.patch
                  version: =0.7.0
              upgradePath:
                - ms@0.7.1
          licenses: []
        dependencyCount: 1
        org:
          name: atokeneduser
          id: 4a18d42f-0706-4ad0-b127-24078731fbed
        licensesPolicy: null
        packageManager: npm
    Testgemfile.lockfileresponse:
      title: Testgemfile.lockfileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues10'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
      example:
        ok: false
        issues:
          vulnerabilities:
            - id: SNYK-RUBY-JSON-20000
              url: https://snyk.io/vuln/SNYK-RUBY-JSON-20000
              title: Denial of Service (DoS)
              type: vuln
              description: >
                ## Overview


                The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.

                Affected versions of this Gem contain an overflow condition. This is triggered when user-supplied input is not properly validated while handling specially crafted data. This can allow a remote attacker to cause a stack-based buffer overflow, resulting in a denial of service, or potentially allowing the [execution of arbitrary code](https://snyk.io/vuln/SNYK-RUBY-JSON-20209).


                ## Details

                Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



                Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



                One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



                When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



                Two common types of DoS vulnerabilities:



                * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



                * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


                ## References

                - http://rubysec.com/advisories/OSVDB-101157
              functions: []
              from:
                - json@1.0.0
              package: json
              version: 1.0.0
              severity: high
              exploitMaturity: no-known-exploit
              language: ruby
              packageManager: rubygems
              semver:
                vulnerable:
                  - < 1.1.0
              publicationTime: 2007-05-20T21:00:00Z
              disclosureTime: 2007-05-20T21:00:00Z
              isUpgradable: true
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-400
                OSVDB:
                  - OSVDB-101157
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
              cvssScore: 7.5
              patches: []
              upgradePath:
                - json@1.1.0
            - id: SNYK-RUBY-JSON-20060
              url: https://snyk.io/vuln/SNYK-RUBY-JSON-20060
              title: Denial of Service (DoS)
              type: vuln
              description: >
                ## Overview

                The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.

                Affected versions of this Gem are vulnerable to Denial of Service (DoS) attacks and unsafe object creation vulnerabilities. When parsing certain JSON documents, the JSON gem tricked into creating Ruby symbols in a target system.


                ## Details


                When parsing certain JSON documents, the JSON gem can be coerced in to creating Ruby symbols in a target system.  Since Ruby symbols are not garbage collected, this can result in a denial of service attack.


                The same technique can be used to create objects in a target system that act like internal objects.  These "act alike" objects can be used to bypass certain security mechanisms and can be used as a spring board for SQL injection attacks in Ruby on Rails.


                Impacted code looks like this:

                ```js

                JSON.parse(user_input)

                ```

                Where the `user_input` variable will have a JSON document like this:

                ```json

                {"json_class":"foo"}

                ```

                The JSON gem will attempt to look up the constant "foo".  Looking up this constant will create a symbol.


                In JSON version 1.7.x, objects with arbitrary attributes can be created using JSON documents like this:

                ```json

                {"json_class":"JSON::GenericObject","foo":"bar"}

                ```

                This document will result in an instance of `JSON::GenericObject`, with the attribute "foo" that has the value "bar".  Instantiating these objects will result in arbitrary symbol creation and in some cases can be used to bypass security measures.


                PLEASE NOTE: this behavior *does not change* when using `JSON.load`.  `JSON.load` should *never* be given input from unknown sources.  If you are processing JSON from an unknown source, *always* use `JSON.parse`.


                ## References

                - https://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/

                - https://gist.github.com/rsierra/4943505
              functions: []
              from:
                - json@1.0.0
              package: json
              version: 1.0.0
              severity: high
              exploitMaturity: no-known-exploit
              language: ruby
              packageManager: rubygems
              semver:
                vulnerable:
                  - < 1.7.7, >= 1.7
                  - < 1.6.8, >= 1.6
                  - < 1.5.5
              publicationTime: 2013-02-10T22:00:00Z
              disclosureTime: 2013-02-10T22:00:00Z
              isUpgradable: true
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2013-0269
                CWE:
                  - CWE-400
                OSVDB:
                  - OSVDB-90074
              credit:
                - Thomas Hollstegge
                - Ben Murphy
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
              cvssScore: 7.3
              patches: []
              upgradePath:
                - json@1.5.5
            - id: SNYK-RUBY-JSON-20209
              url: https://snyk.io/vuln/SNYK-RUBY-JSON-20209
              title: Arbitrary Code Execution
              type: vuln
              description: >
                ## Overview


                The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.


                Affected versions of this Gem contain an overflow condition. This is triggered when user-supplied input is not properly validated while handling specially crafted data. This can allow a remote attacker to cause a stack-based buffer overflow, resulting in a [denial of service](https://snyk.io/vuln/SNYK-RUBY-JSON-20000), or potentially allowing the execution of arbitrary code.


                ## References


                - http://rubysec.com/advisories/OSVDB-101157
              functions: []
              from:
                - json@1.0.0
              package: json
              version: 1.0.0
              severity: high
              exploitMaturity: no-known-exploit
              language: ruby
              packageManager: rubygems
              semver:
                vulnerable:
                  - < 1.1.0
              publicationTime: 2007-05-20T21:00:00Z
              disclosureTime: 2007-05-20T21:00:00Z
              isUpgradable: true
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE: []
                CWE:
                  - CWE-94
                OSVDB:
                  - OSVDB-101157-1
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
              cvssScore: 7.5
              patches: []
              upgradePath:
                - json@1.1.0
            - id: SNYK-RUBY-RACK-538324
              url: https://snyk.io/vuln/SNYK-RUBY-RACK-538324
              title: Information Exposure
              type: vuln
              description: >
                ## Overview


                [rack](https://rack.github.io/) is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.



                Affected versions of this package are vulnerable to Information Exposure.

                Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.


                ## Remediation


                Upgrade `rack` to version 1.6.12, 2.0.8 or higher.



                ## References


                - [GitHub Fix Commit](https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38)


                - [GitHub Security Advisory](https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3)
              functions: []
              from:
                - redis-rack-cache@1.1
                - rack-cache@1.1
                - rack@2.0.1
              package: rack
              version: 2.0.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: ruby
              packageManager: rubygems
              semver:
                vulnerable:
                  - <1.6.12
                  - '>=2.0.0.alpha, <2.0.8'
              publicationTime: 2019-12-19T20:24:49Z
              disclosureTime: 2019-12-18T20:24:49Z
              isUpgradable: true
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2019-16782
                CWE:
                  - CWE-200
              credit:
                - Will Leinweber
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
              cvssScore: 5.3
              patches: []
              upgradePath:
                - redis-rack-cache@1.1
                - rack-cache@1.1
                - rack@2.0.8
            - id: SNYK-RUBY-RACK-72567
              url: https://snyk.io/vuln/SNYK-RUBY-RACK-72567
              title: Cross-site Scripting (XSS)
              type: vuln
              description: >
                ## Overview


                [rack](https://rack.github.io/) is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.



                Affected versions of this package are vulnerable to Cross-site Scripting (XSS)

                via the `scheme` method on `Rack::Request`.


                ## Remediation


                Upgrade `rack` to version 1.6.11, 2.0.6 or higher.



                ## References


                - [GitHub Commit](https://github.com/rack/rack/commit/313dd6a05a5924ed6c82072299c53fed09e39ae7)


                - [Google Security Forum](https://groups.google.com/forum/#!msg/rubyonrails-security/GKsAFT924Ag/DYtk-Xl6AAAJ)


                - [RedHat Bugzilla Bug](https://bugzilla.redhat.com/show_bug.cgi?id=1646818)
              functions: []
              from:
                - redis-rack-cache@1.1
                - rack-cache@1.1
                - rack@2.0.1
              package: rack
              version: 2.0.1
              severity: medium
              exploitMaturity: no-known-exploit
              language: ruby
              packageManager: rubygems
              semver:
                vulnerable:
                  - <1.6.11
                  - '>=2.0.0, <2.0.6'
              publicationTime: 2018-11-06T16:08:37Z
              disclosureTime: 2018-08-22T15:56:49Z
              isUpgradable: true
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2018-16470
                CWE:
                  - CWE-79
              credit:
                - Aaron Patterson
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
              cvssScore: 6.1
              patches: []
              upgradePath:
                - redis-rack-cache@1.1
                - rack-cache@1.1
                - rack@2.0.6
            - id: SNYK-RUBY-RACKCACHE-20031
              url: https://snyk.io/vuln/SNYK-RUBY-RACKCACHE-20031
              title: HTTP Header Caching Weakness
              type: vuln
              description: >
                ## Overview

                [rack-cache](https://rubygems.org/gems/rack-cache) enables HTTP caching for Rack-based applications.

                Affected versions of this gem contain a flaw related to the rubygem caching sensitive HTTP headers. This will result in a weakness that may make it easier for an attacker to gain access to a user's session via a specially crafted header.


                ## References

                - http://rubysec.com/advisories/CVE-2012-2671
              functions: []
              from:
                - redis-rack-cache@1.1
                - rack-cache@1.1
              package: rack-cache
              version: '1.1'
              severity: high
              exploitMaturity: no-known-exploit
              language: ruby
              packageManager: rubygems
              semver:
                vulnerable:
                  - < 1.2
              publicationTime: 2012-06-05T21:00:00Z
              disclosureTime: 2012-06-05T21:00:00Z
              isUpgradable: true
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2012-2671
                CWE:
                  - CWE-444
                OSVDB:
                  - OSVDB-83077
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
              cvssScore: 7.3
              patches: []
              upgradePath:
                - redis-rack-cache@1.2
                - rack-cache@1.2
            - id: SNYK-RUBY-REDISSTORE-20452
              url: https://snyk.io/vuln/SNYK-RUBY-REDISSTORE-20452
              title: Deserialization of Untrusted Data
              type: vuln
              description: >
                ## Overview

                [`redis-store`](https://rubygems.org/gems/redis-store) is a namespaced Rack::Session, Rack::Cache, I18n and cache Redis stores for Ruby web frameworks.


                Affected versions of the package are vulnerable to Deserialization of Untrusted Data.


                # Details

                Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse process of creating object from sequence of bytes is called deserialization. Serialization is commonly used for communication (sharing objects between multiple hosts) and persistence (store the object state in a file or a database). It is an integral part of popular protocols like _Remote Method Invocation (RMI)_, _Java Management Extension (JMX)_, _Java Messaging System (JMS)_, _Action Message Format (AMF)_, _Java Server Faces (JSF) ViewState_, etc.


                _Deserialization of untrusted data_ ([CWE-502](https://cwe.mitre.org/data/definitions/502.html)), is when the application deserializes untrusted data without sufficiently verifying that the resulting data will be valid, letting the attacker to control the state or the flow of the execution.


                An attacker just needs to identify a piece of software that has both a vulnerable class on its path, and performs deserialization on untrusted data. Then all they need to do is send the payload into the deserializer, getting the command executed.


                ## Remediation

                Upgrade `redis-store` to version 1.4.0 or higher.


                ## References

                - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2017-1000248)

                - [GitHub PR](https://github.com/redis-store/redis-store/pull/290)

                - [GitHub Issue](https://github.com/redis-store/redis-store/issues/289)

                - [GitHub Commit](https://github.com/redis-store/redis-store/commit/e0c1398d54a9661c8c70267c3a925ba6b192142e)
              functions: []
              from:
                - redis-rack-cache@1.1
                - redis-store@1.1.0
              package: redis-store
              version: 1.1.0
              severity: critical
              exploitMaturity: no-known-exploit
              language: ruby
              packageManager: rubygems
              semver:
                vulnerable:
                  - <1.4.0
              publicationTime: 2017-12-07T09:52:33.659000Z
              disclosureTime: 2017-08-10T21:00:00Z
              isUpgradable: true
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2017-1000248
                CWE:
                  - CWE-502
              credit:
                - Dylan Katz
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
              cvssScore: 9.8
              patches: []
              upgradePath:
                - redis-rack-cache@2.0.2
                - redis-store@1.4.0
          licenses: []
        dependencyCount: 6
        org:
          name: atokeneduser
          id: 4a18d42f-0706-4ad0-b127-24078731fbed
        licensesPolicy: null
        packageManager: rubygems
    TestGopkg.tomlGopkg.lockFileresponse:
      title: TestGopkg.tomlGopkg.lockFileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues6'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
    Testgradlefileresponse:
      title: Testgradlefileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues1'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
      example:
        ok: false
        issues:
          vulnerabilities:
            - id: SNYK-JAVA-AXIS-30071
              url: https://snyk.io/vuln/SNYK-JAVA-AXIS-30071
              title: Man-in-the-Middle (MitM)
              type: vuln
              description: "## Overview\n\n[axis:axis](https://search.maven.org/search?q=g:axis) is an implementation of the SOAP (\"Simple Object Access Protocol\") submission to W3C.\n\n\nAffected versions of this package are vulnerable to Man-in-the-Middle (MitM).\nIt does not verify the requesting server's hostname against existing domain names in the SSL Certificate. \r\n\r\n## Details\r\nThe `getCN` function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's `Common Name (CN)` or `subjectAltName` field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  \r\n\r\n**NOTE:** this issue exists because of an incomplete fix for [CVE-2012-5784](https://snyk.io/vuln/SNYK-JAVA-AXIS-30189).\n\n## Remediation\n\nThere is no fixed version for `axis:axis`.\n\n\n## References\n\n- [Axis Issue](https://issues.apache.org/jira/browse/AXIS-2905)\n\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3596)\n\n- [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3596)\n"
              functions: []
              from:
                - axis:axis@1.4
              package: axis:axis
              version: '1.4'
              severity: medium
              exploitMaturity: no-known-exploit
              language: java
              packageManager: maven
              semver:
                vulnerable:
                  - '[0,]'
              publicationTime: 2014-08-18T16:51:53Z
              disclosureTime: 2014-08-18T16:51:53Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2014-3596
                CWE:
                  - CWE-297
              credit:
                - David Jorm
                - Arun Neelicattu
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
              cvssScore: 5.4
              patches: []
              upgradePath: []
            - id: SNYK-JAVA-AXIS-30189
              url: https://snyk.io/vuln/SNYK-JAVA-AXIS-30189
              title: Man-in-the-Middle (MitM)
              type: vuln
              description: >
                ## Overview


                [axis:axis](https://search.maven.org/search?q=g:axis) is an implementation of the SOAP ("Simple Object Access Protocol") submission to W3C.



                Affected versions of this package are vulnerable to Man-in-the-Middle (MitM).

                It does not verify the requesting server's hostname against existing domain names in the SSL Certificate.



                ## Details

                Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's `Common Name (CN)` or `subjectAltName` field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


                ## Remediation


                There is no fixed version for `axis:axis`.



                ## References


                - [Jira Issue](https://issues.apache.org/jira/browse/AXIS-2883)


                - [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-5784)


                - [Texas University](http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf)
              functions: []
              from:
                - axis:axis@1.4
              package: axis:axis
              version: '1.4'
              severity: medium
              exploitMaturity: no-known-exploit
              language: java
              packageManager: maven
              semver:
                vulnerable:
                  - '[0,]'
              publicationTime: 2017-03-13T08:00:21Z
              disclosureTime: 2012-11-04T22:55:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: false
              identifiers:
                CVE:
                  - CVE-2012-5784
                CWE:
                  - CWE-20
              credit:
                - Alberto Fernández
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
              cvssScore: 5.4
              patches: []
              upgradePath: []
          licenses: []
        dependencyCount: 6
        org:
          name: atokeneduser
          id: 4a18d42f-0706-4ad0-b127-24078731fbed
        licensesPolicy: null
        packageManager: gradle
    Testmavenfileresponse:
      title: Testmavenfileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues3'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
    Testpackage.jsonpackage-lock.jsonFileresponse:
      title: Testpackage.jsonpackage-lock.jsonFileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues5'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
    Testpackage.jsonyarn.lockFileresponse:
      title: Testpackage.jsonyarn.lockFileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues5'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
    Testrequirements.txtfileresponse:
      title: Testrequirements.txtfileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues1'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
      example:
        ok: false
        issues:
          vulnerabilities:
            - id: SNYK-PYTHON-OAUTH2-40013
              url: https://snyk.io/vuln/SNYK-PYTHON-OAUTH2-40013
              title: Replay Attack
              type: vuln
              description: >+
                ## Overview

                [`oauth2`](https://pypi.python.org/pypi/oauth2) is a library for OAuth version 1.9

                The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.



                ## Remediation

                Upgrade to version `1.9rc1` or greater.



                ## References

                - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2013-4346)

                - [Bugzilla redhat](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4346)

                - [GitHub Issue](https://github.com/simplegeo/python-oauth2/issues/129)

              functions: []
              from:
                - oauth2@1.5.211
              package: oauth2
              version: 1.5.211
              severity: medium
              exploitMaturity: no-known-exploit
              language: python
              packageManager: pip
              semver:
                vulnerable:
                  - '[,1.9rc1)'
              publicationTime: 2013-02-05T12:31:58Z
              disclosureTime: 2013-02-05T12:31:58Z
              isUpgradable: false
              isPatchable: false
              isPinnable: true
              identifiers:
                CVE:
                  - CVE-2013-4346
                CWE:
                  - CWE-310
              credit:
                - André Cruz
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
              cvssScore: 4.3
              patches: []
              upgradePath: []
            - id: SNYK-PYTHON-OAUTH2-40014
              url: https://snyk.io/vuln/SNYK-PYTHON-OAUTH2-40014
              title: Insecure Randomness
              type: vuln
              description: >+
                ## Overview

                [`oauth2`](https://pypi.python.org/pypi/oauth2) is a library for OAuth version 1.9



                Affected versions of this package are vulnerable to Insecure Randomness.

                The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.



                ## Remediation

                Upgrade to version `1.9rc1` or greater.



                ## References

                - [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4347)

                - [GitHub Issue](https://github.com/simplegeo/python-oauth2/issues/9)

                - [Openwall](http://www.openwall.com/lists/oss-security/2013/09/12/7)

                - [GitHub PR](https://github.com/simplegeo/python-oauth2/pull/146)

              functions: []
              from:
                - oauth2@1.5.211
              package: oauth2
              version: 1.5.211
              severity: medium
              exploitMaturity: no-known-exploit
              language: python
              packageManager: pip
              semver:
                vulnerable:
                  - '[,1.9rc1)'
              publicationTime: 2017-04-13T12:31:58Z
              disclosureTime: 2014-05-20T14:55:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: true
              identifiers:
                CVE:
                  - CVE-2013-4347
                CWE:
                  - CWE-310
              credit:
                - Unknown
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
              cvssScore: 5.4
              patches: []
              upgradePath: []
            - id: SNYK-PYTHON-SUPERVISOR-40610
              url: https://snyk.io/vuln/SNYK-PYTHON-SUPERVISOR-40610
              title: Arbitrary Command Execution
              type: vuln
              description: >-
                ## Overview

                [`supervisor`](https://pypi.python.org/pypi/supervisor/) is a client/server system that allows its users to monitor and control a number of processes on UNIX-like operating systems.



                Affected versions of the package are vulnerable to Arbitrary Command Execution. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to `supervisord` that will run arbitrary shell commands on the server. The commands will be run as the same user as `supervisord`. Depending on how `supervisord` has been configured, this may be root.



                ## Details

                * `supervisord` is the server component and is responsible for starting child processes, responding to commands from clients, and other commands.

                * `supervisorctl` is the command line component, providing a shell-like interface to the features provided by `supervisord`.



                `supervisord` can be configured to run an HTTP server on a TCP socket and/or a Unix domain socket. This HTTP server is how `supervisorctl` communicates with `supervisord`. If an HTTP server has been enabled, it will always serve both HTML pages and an XML-RPC interface. A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to `supervisord` that will run arbitrary shell commands on the server. The commands will be run as the same user as `supervisord`. Depending on how `supervisord` has been configured, this may be root.

                This vulnerability can only be exploited by an authenticated client or if `supervisord` has been configured to run an HTTP server without authentication. If authentication has not been enabled, `supervisord` will log a message at the critical level every time it starts.



                ## PoC by Maor Shwartz



                Create a config file `supervisord.conf`:



                ```conf

                [supervisord]

                loglevel = trace



                [inet_http_server]

                port = 127.0.0.1:9001



                [rpcinterface:supervisor]

                supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface

                ```



                Start supervisord in the foreground with that config file:



                ```

                $ supervisord -n -c supervisord.conf

                ```



                In a new terminal:



                ```py

                $ python2

                >>> from xmlrpclib import ServerProxy

                >>> server = ServerProxy('http://127.0.0.1:9001/RPC2')

                >>> server.supervisor.supervisord.options.execve('/bin/sh', [], {})

                  ```



                If the `supervisord` version is vulnerable, the `execve` will be executed and the `supervisord` process will be replaced with /bin/sh (or any other command given). If the `supervisord` version is not vulnerable, it will return an `UNKNOWN_METHOD` fault.





                ## Remediation

                Upgrade `supervisor` to version 3.3.3 or higher.



                ## References

                - [Github Issue](https://github.com/Supervisor/supervisor/issues/964)

                - [Github Commit 3.0.1](https://github.com/Supervisor/supervisor/commit/83060f3383ebd26add094398174f1de34cf7b7f0)

                - [Github Commit 3.1.4](https://github.com/Supervisor/supervisor/commit/dbe0f55871a122eac75760aef511efc3a8830b88)

                - [Github Commit 3.2.4](https://github.com/Supervisor/supervisor/commit/aac3c21893cab7361f5c35c8e20341b298f6462e)

                - [Github Commit 3.3.3](https://github.com/Supervisor/supervisor/commit/058f46141e346b18dee0497ba11203cb81ecb19e)
              functions: []
              from:
                - supervisor@3.1.0
              package: supervisor
              version: 3.1.0
              severity: high
              exploitMaturity: mature
              language: python
              packageManager: pip
              semver:
                vulnerable:
                  - '[3.0a1,3.0.1)'
                  - '[3.1.0,3.1.4)'
                  - '[3.2.0,3.2.4)'
                  - '[3.3.0,3.3.3)'
              publicationTime: 2017-08-08T06:59:14Z
              disclosureTime: 2017-07-18T21:00:00Z
              isUpgradable: false
              isPatchable: false
              isPinnable: true
              identifiers:
                CVE:
                  - CVE-2017-11610
                CWE:
                  - CWE-94
              credit:
                - Maor Shwartz
              CVSSv3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C
              cvssScore: 8.8
              patches: []
              upgradePath: []
          licenses: []
        dependencyCount: 4
        org:
          name: atokeneduser
          id: 4a18d42f-0706-4ad0-b127-24078731fbed
        licensesPolicy: null
        packageManager: pip
    Testsbtfileresponse:
      title: Testsbtfileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues14'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
    Testvendor.jsonFileresponse:
      title: Testvendor.jsonFileresponse
      required:
        - ok
        - issues
        - dependencyCount
        - org
        - licensesPolicy
        - packageManager
      type: object
      properties:
        ok:
          type: boolean
        issues:
          $ref: '#/components/schemas/Issues7'
        dependencyCount:
          type: integer
          format: int32
        org:
          $ref: '#/components/schemas/Org1'
        licensesPolicy:
          type: string
          nullable: true
        packageManager:
          type: string
    Updateamemberintheorganizationrequest:
      title: Updateamemberintheorganizationrequest
      type: object
      properties:
        role:
          type: string
          description: The new role of the user, "admin" or "collaborator".
    Updateamembersroleintheorganizationrequest:
      title: Updateamembersroleintheorganizationrequest
      type: object
      properties:
        rolePublicId:
          type: string
          description: The new role public ID to update the user to.
    Updateaprojectrequest:
      title: Updateaprojectrequest
      type: object
      properties:
        owner:
          $ref: '#/components/schemas/owner'
        branch:
          type: string
          description: The branch that this project should be monitoring
          example: main
    Updateexistingintegrationrequest:
      title: Setup Broker for Existing Integration
      required:
        - type
      type: object
      properties:
        type:
          $ref: '#/components/schemas/IntegrationType'
        broker:
          $ref: '#/components/schemas/BrokerSettings'
    Updateexistingintegrationrequest1:
      title: Update credentials for an existing non-brokered integration
      required:
        - type
        - credentials
      type: object
      properties:
        type:
          $ref: '#/components/schemas/IntegrationType'
        credentials:
          $ref: '#/components/schemas/IntegrationCredentials'
    Updateexistingintegrationrequest2:
      title: Disable broker for an existing integration
      required:
        - type
        - broker
        - credentials
      type: object
      properties:
        type:
          $ref: '#/components/schemas/IntegrationType'
        broker:
          $ref: '#/components/schemas/BrokerSettings'
        credentials:
          $ref: '#/components/schemas/IntegrationCredentials'
    Updateexistingintegrationresponse:
      title: Updateexistingintegrationresponse
      required:
        - id
        - brokerToken
      type: object
      properties:
        id:
          type: string
        brokerToken:
          type: string
      example:
        id: 9a3e5d90-b782-468a-a042-9a2073736f0b
        brokerToken: 4a18d42f-0706-4ad0-b127-24078731fbed
    Updateexistingintegrationresponse1:
      title: Updateexistingintegrationresponse1
      required:
        - id
      type: object
      properties:
        id:
          type: string
      example:
        id: 9a3e5d90-b782-468a-a042-9a2073736f0b
    vuln:
      title: vuln
      required:
        - low
        - medium
        - high
        - critical
      type: object
      properties:
        low:
          type: number
          description: Number of low severity vulnerabilities
        medium:
          type: number
          description: Number of medium severity vulnerabilities
        high:
          type: number
          description: Number of high severity vulnerabilities
        critical:
          type: number
          description: Number of critical severity vulnerabilities
    Vulnerability1:
      title: Vulnerability1
      required:
        - id
        - url
        - title
        - type
        - description
        - functions
        - from
        - package
        - version
        - severity
        - exploitMaturity
        - language
        - packageManager
        - semver
        - publicationTime
        - disclosureTime
        - isUpgradable
        - isPatchable
        - isPinnable
        - identifiers
        - credit
        - CVSSv3
        - cvssScore
        - patches
        - upgradePath
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        title:
          type: string
        type:
          type: string
        description:
          type: string
        functions:
          type: array
          items:
            type: string
          description: ''
        from:
          type: array
          items:
            type: string
          description: ''
        package:
          type: string
        version:
          type: string
        severity:
          type: string
        exploitMaturity:
          type: string
        language:
          type: string
        packageManager:
          type: string
        semver:
          $ref: '#/components/schemas/Semver2'
        publicationTime:
          type: string
        disclosureTime:
          type: string
        isUpgradable:
          type: boolean
        isPatchable:
          type: boolean
        isPinnable:
          type: boolean
        identifiers:
          $ref: '#/components/schemas/Identifiers2'
        credit:
          type: array
          items:
            type: string
          description: ''
        CVSSv3:
          type: string
        cvssScore:
          type: number
        patches:
          type: array
          items:
            type: string
          description: ''
        upgradePath:
          type: array
          items:
            type: string
          description: ''
      example:
        id: SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
        url: https://snyk.io/vuln/SNYK-JAVA-ORGAPACHEFLEXBLAZEDS-31455
        title: Arbitrary Code Execution
        type: vuln
        description: >
          ## Overview


          [org.apache.flex.blazeds:blazeds](https://github.com/apache/flex-blazeds) is an application development framework for easily building Flash-based applications for mobile devices, web browsers, and desktops.



          Affected versions of this package are vulnerable to Arbitrary Code Execution.

          The AMF deserialization implementation of Flex BlazeDS is vulnerable to Deserialization of Untrusted Data. By sending a specially crafted AMF message, it is possible to make the server establish a connection to an endpoint specified in the message and request an RMI remote object from that endpoint. This can result in the execution of arbitrary code on the server via Java deserialization.



          Starting with BlazeDS version `4.7.3`, Deserialization of XML is disabled completely per default, while the `ClassDeserializationValidator` allows deserialization of whitelisted classes only. BlazeDS internally comes with the following whitelist:

          ```

          flex.messaging.io.amf.ASObject

          flex.messaging.io.amf.SerializedObject

          flex.messaging.io.ArrayCollection

          flex.messaging.io.ArrayList

          flex.messaging.messages.AcknowledgeMessage

          flex.messaging.messages.AcknowledgeMessageExt

          flex.messaging.messages.AsyncMessage

          flex.messaging.messages.AsyncMessageExt

          flex.messaging.messages.CommandMessage

          flex.messaging.messages.CommandMessageExt

          flex.messaging.messages.ErrorMessage

          flex.messaging.messages.HTTPMessage

          flex.messaging.messages.RemotingMessage

          flex.messaging.messages.SOAPMessage

          java.lang.Boolean

          java.lang.Byte

          java.lang.Character

          java.lang.Double

          java.lang.Float

          java.lang.Integer

          java.lang.Long

          java.lang.Object

          java.lang.Short

          java.lang.String

          java.util.ArrayList

          java.util.Date

          java.util.HashMap

          org.w3c.dom.Document

          ```


          ## Remediation


          Upgrade `org.apache.flex.blazeds:blazeds` to version 4.7.3 or higher.



          ## References


          - [CVE-2017-3066](https://nvd.nist.gov/vuln/detail/CVE-2017-5641)


          - [Github Commit](https://github.com/apache/flex-blazeds/commit/f861f0993c35e664906609cad275e45a71e2aaf1)


          - [Github Release Notes](https://github.com/apache/flex-blazeds/blob/master/RELEASE_NOTES)


          - [Securitytracker Issue](http://www.securitytracker.com/id/1038364)
        functions: []
        from:
          - org.apache.flex.blazeds:blazeds@4.7.2
        package: org.apache.flex.blazeds:blazeds
        version: 4.7.2
        severity: critical
        exploitMaturity: no-known-exploit
        language: java
        packageManager: maven
        semver:
          vulnerable:
            - '[,4.7.3)'
        publicationTime: 2017-08-09T14:17:08Z
        disclosureTime: 2017-04-25T21:00:00Z
        isUpgradable: true
        isPatchable: false
        isPinnable: false
        identifiers:
          CVE:
            - CVE-2017-5641
          CWE:
            - CWE-502
        credit:
          - Markus Wulftange
        CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
        cvssScore: 9.8
        patches: []
        upgradePath:
          - org.apache.flex.blazeds:blazeds@4.7.3
    Vulnerability2:
      title: Vulnerability2
      required:
        - id
        - url
        - title
        - type
        - description
        - functions
        - from
        - package
        - version
        - severity
        - exploitMaturity
        - language
        - packageManager
        - semver
        - publicationTime
        - disclosureTime
        - isUpgradable
        - isPatchable
        - isPinnable
        - identifiers
        - credit
        - CVSSv3
        - cvssScore
        - patches
        - upgradePath
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        title:
          type: string
        type:
          type: string
        description:
          type: string
        functions:
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Function1'
              - allOf:
                  - $ref: '#/components/schemas/Function11'
                  - example:
                      functionId:
                        className: org.apache.zookeeper.server.NIOServerCnxn
                        functionName: checkFourLetterWord
                      version:
                        - '[,3.3.7)'
          description: ''
        from:
          type: array
          items:
            type: string
          description: ''
        package:
          type: string
        version:
          type: string
        severity:
          type: string
        exploitMaturity:
          type: string
        language:
          type: string
        packageManager:
          type: string
        semver:
          $ref: '#/components/schemas/Semver2'
        publicationTime:
          type: string
        disclosureTime:
          type: string
        isUpgradable:
          type: boolean
        isPatchable:
          type: boolean
        isPinnable:
          type: boolean
        identifiers:
          $ref: '#/components/schemas/Identifiers2'
        credit:
          type: array
          items:
            type: string
          description: ''
        CVSSv3:
          type: string
        cvssScore:
          oneOf:
            - type: number
            - type: integer
              format: int32
        patches:
          type: array
          items:
            type: string
          description: ''
        upgradePath:
          type: array
          items:
            type: string
          description: ''
      example:
        id: SNYK-JAVA-AXIS-30071
        url: https://snyk.io/vuln/SNYK-JAVA-AXIS-30071
        title: Man-in-the-Middle (MitM)
        type: vuln
        description: "## Overview\n\n[axis:axis](https://search.maven.org/search?q=g:axis) is an implementation of the SOAP (\"Simple Object Access Protocol\") submission to W3C.\n\n\nAffected versions of this package are vulnerable to Man-in-the-Middle (MitM).\nIt does not verify the requesting server's hostname against existing domain names in the SSL Certificate. \r\n\r\n## Details\r\nThe `getCN` function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's `Common Name (CN)` or `subjectAltName` field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  \r\n\r\n**NOTE:** this issue exists because of an incomplete fix for [CVE-2012-5784](https://snyk.io/vuln/SNYK-JAVA-AXIS-30189).\n\n## Remediation\n\nThere is no fixed version for `axis:axis`.\n\n\n## References\n\n- [Axis Issue](https://issues.apache.org/jira/browse/AXIS-2905)\n\n- [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3596)\n\n- [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3596)\n"
        functions: []
        from:
          - axis:axis@1.4
        package: axis:axis
        version: '1.4'
        severity: medium
        exploitMaturity: no-known-exploit
        language: java
        packageManager: maven
        semver:
          vulnerable:
            - '[0,]'
        publicationTime: 2014-08-18T16:51:53Z
        disclosureTime: 2014-08-18T16:51:53Z
        isUpgradable: false
        isPatchable: false
        isPinnable: false
        identifiers:
          CVE:
            - CVE-2014-3596
          CWE:
            - CWE-297
        credit:
          - David Jorm
          - Arun Neelicattu
        CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
        cvssScore: 5.4
        patches: []
        upgradePath: []
    Vulnerability3:
      title: Vulnerability3
      required:
        - id
        - url
        - title
        - type
        - description
        - functions
        - from
        - package
        - version
        - severity
        - exploitMaturity
        - language
        - packageManager
        - semver
        - publicationTime
        - disclosureTime
        - isUpgradable
        - isPatchable
        - isPinnable
        - identifiers
        - credit
        - CVSSv3
        - cvssScore
        - patches
        - upgradePath
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        title:
          type: string
        type:
          type: string
        description:
          type: string
        functions:
          type: array
          items:
            $ref: '#/components/schemas/Function2'
          description: ''
        from:
          type: array
          items:
            type: string
          description: ''
        package:
          type: string
        version:
          type: string
        severity:
          type: string
        exploitMaturity:
          type: string
        language:
          type: string
        packageManager:
          type: string
        semver:
          $ref: '#/components/schemas/Semver2'
        publicationTime:
          type: string
        disclosureTime:
          type: string
        isUpgradable:
          type: boolean
        isPatchable:
          type: boolean
        isPinnable:
          type: boolean
        identifiers:
          $ref: '#/components/schemas/Identifiers4'
        credit:
          type: array
          items:
            type: string
          description: ''
        CVSSv3:
          type: string
        cvssScore:
          type: number
        patches:
          type: array
          items:
            $ref: '#/components/schemas/Patches2'
          description: ''
        upgradePath:
          type: array
          items:
            type: string
          description: ''
      example:
        id: npm:ms:20151024
        url: https://snyk.io/vuln/npm:ms:20151024
        title: Regular Expression Denial of Service (ReDoS)
        type: vuln
        description: >
          ## Overview


          [ms](https://www.npmjs.com/package/ms) is a tiny millisecond conversion utility.



          Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS)

          attack when converting a time period string (i.e. `"2 days"`, `"1h"`) into a milliseconds integer. A malicious user could pass extremely long strings to `ms()`, causing the server to take a long time to process, subsequently blocking the event loop for that extended period.


          ## Details

          Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its original and legitimate users. There are many types of DoS attacks, ranging from trying to clog the network pipes to the system by generating a large volume of traffic from many machines (a Distributed Denial of Service - DDoS - attack) to sending crafted requests that cause a system to crash or take a disproportional amount of time to process.



          The Regular expression Denial of Service (ReDoS) is a type of Denial of Service attack. Regular expressions are incredibly powerful, but they aren't very intuitive and can ultimately end up making it easy for attackers to take your site down.



          Let’s take the following regular expression as an example:

          ```js

          regex = /A(B|C+)+D/

          ```



          This regular expression accomplishes the following:

          - `A` The string must start with the letter 'A'

          - `(B|C+)+` The string must then follow the letter A with either the letter 'B' or some number of occurrences of the letter 'C' (the `+` matches one or more times). The `+` at the end of this section states that we can look for one or more matches of this section.

          - `D` Finally, we ensure this section of the string ends with a 'D'



          The expression would match inputs such as `ABBD`, `ABCCCCD`, `ABCBCCCD` and `ACCCCCD`



          It most cases, it doesn't take very long for a regex engine to find a match:



          ```bash

          $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCD")'

          0.04s user 0.01s system 95% cpu 0.052 total



          $ time node -e '/A(B|C+)+D/.test("ACCCCCCCCCCCCCCCCCCCCCCCCCCCCX")'

          1.79s user 0.02s system 99% cpu 1.812 total

          ```



          The entire process of testing it against a 30 characters long string takes around ~52ms. But when given an invalid string, it takes nearly two seconds to complete the test, over ten times as long as it took to test a valid string. The dramatic difference is due to the way regular expressions get evaluated.



          Most Regex engines will work very similarly (with minor differences). The engine will match the first possible way to accept the current character and proceed to the next one. If it then fails to match the next one, it will backtrack and see if there was another way to digest the previous character. If it goes too far down the rabbit hole only to find out the string doesn’t match in the end, and if many characters have multiple valid regex paths, the number of backtracking steps can become very large, resulting in what is known as _catastrophic backtracking_.



          Let's look at how our expression runs into this problem, using a shorter string: "ACCCX". While it seems fairly straightforward, there are still four different ways that the engine could match those three C's:

          1. CCC

          2. CC+C

          3. C+CC

          4. C+C+C.



          The engine has to try each of those combinations to see if any of them potentially match against the expression. When you combine that with the other steps the engine must take, we can use [RegEx 101 debugger](https://regex101.com/debugger) to see the engine has to take a total of 38 steps before it can determine the string doesn't match.



          From there, the number of steps the engine must use to validate a string just continues to grow.



          | String | Number of C's | Number of steps |

          | -------|-------------:| -----:|

          | ACCCX | 3 | 38

          | ACCCCX | 4 | 71

          | ACCCCCX | 5 | 136

          | ACCCCCCCCCCCCCCX | 14 | 65,553





          By the time the string includes 14 C's, the engine has to take over 65,000 steps just to see if the string is valid. These extreme situations can cause them to work very slowly (exponentially related to input size, as shown above), allowing an attacker to exploit this and can cause the service to excessively consume CPU, resulting in a Denial of Service.


          ## Remediation


          Upgrade `ms` to version 0.7.1 or higher.



          ## References


          - [OSS Security advisory](https://www.openwall.com/lists/oss-security/2016/04/20/11)


          - [OWASP - ReDoS](https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS)


          - [Security Focus](https://www.securityfocus.com/bid/96389)
        functions:
          - functionId:
              filePath: ms.js
              functionName: parse
            version:
              - '>0.1.0 <=0.3.0'
          - functionId:
              filePath: index.js
              functionName: parse
            version:
              - '>0.3.0 <0.7.1'
        from:
          - ms@0.7.0
        package: ms
        version: 0.7.0
        severity: medium
        exploitMaturity: no-known-exploit
        language: js
        packageManager: npm
        semver:
          vulnerable:
            - <0.7.1
        publicationTime: 2015-11-06T02:09:36Z
        disclosureTime: 2015-10-24T20:39:59Z
        isUpgradable: true
        isPatchable: true
        isPinnable: false
        identifiers:
          ALTERNATIVE:
            - SNYK-JS-MS-10064
          CVE:
            - CVE-2015-8315
          CWE:
            - CWE-400
          NSP:
            - 46
        credit:
          - Adam Baldwin
        CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
        cvssScore: 5.3
        patches:
          - comments: []
            id: patch:npm:ms:20151024:5
            modificationTime: 2019-12-03T11:40:45.777474Z
            urls:
              - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_5_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk5.patch
            version: =0.1.0
          - comments: []
            id: patch:npm:ms:20151024:4
            modificationTime: 2019-12-03T11:40:45.776329Z
            urls:
              - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_4_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk4.patch
            version: =0.2.0
          - comments: []
            id: patch:npm:ms:20151024:3
            modificationTime: 2019-12-03T11:40:45.775292Z
            urls:
              - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_3_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk3.patch
            version: =0.3.0
          - comments: []
            id: patch:npm:ms:20151024:2
            modificationTime: 2019-12-03T11:40:45.774221Z
            urls:
              - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_2_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk2.patch
            version: <0.6.0 >0.3.0
          - comments: []
            id: patch:npm:ms:20151024:1
            modificationTime: 2019-12-03T11:40:45.773094Z
            urls:
              - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_1_0_48701f029417faf65e6f5e0b61a3cebe5436b07b_snyk.patch
            version: <0.7.0 >=0.6.0
          - comments: []
            id: patch:npm:ms:20151024:0
            modificationTime: 2019-12-03T11:40:45.772009Z
            urls:
              - https://snyk-patches.s3.amazonaws.com/npm/ms/20151024/ms_20151024_0_0_48701f029417faf65e6f5e0b61a3cebe5436b07b.patch
            version: =0.7.0
        upgradePath:
          - ms@0.7.1
    Vulnerability4:
      title: Vulnerability4
      required:
        - id
        - url
        - title
        - type
        - description
        - functions
        - from
        - package
        - version
        - severity
        - exploitMaturity
        - language
        - packageManager
        - semver
        - publicationTime
        - disclosureTime
        - isUpgradable
        - isPatchable
        - isPinnable
        - identifiers
        - credit
        - CVSSv3
        - cvssScore
        - patches
        - upgradePath
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        title:
          type: string
        type:
          type: string
        description:
          type: string
        functions:
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Function3'
              - allOf:
                  - $ref: '#/components/schemas/Function2'
                  - example:
                      functionId:
                        filePath: index.js
                        functionName: compact
                      version:
                        - <1.0.0
          description: ''
        from:
          type: array
          items:
            type: string
          description: ''
        package:
          type: string
        version:
          type: string
        severity:
          type: string
        exploitMaturity:
          type: string
        language:
          type: string
        packageManager:
          type: string
        semver:
          $ref: '#/components/schemas/Semver2'
        publicationTime:
          type: string
        disclosureTime:
          type: string
        isUpgradable:
          type: boolean
        isPatchable:
          type: boolean
        isPinnable:
          type: boolean
        identifiers:
          $ref: '#/components/schemas/Identifiers5'
        credit:
          type: array
          items:
            type: string
          description: ''
        CVSSv3:
          type: string
        cvssScore:
          type: number
        patches:
          type: array
          items:
            $ref: '#/components/schemas/Patches2'
          description: ''
        upgradePath:
          type: array
          items:
            type: string
          description: ''
      example:
        id: npm:node-uuid:20160328
        url: https://snyk.io/vuln/npm:node-uuid:20160328
        title: Insecure Randomness
        type: vuln
        description: >
          ## Overview

          [`node-uuid`](https://github.com/kelektiv/node-uuid) is a Simple, fast generation of RFC4122 UUIDS.


          Affected versions of this package are vulnerable to Insecure Randomness. It uses the cryptographically insecure `Math.random` which can produce predictable values and should not be used in security-sensitive context.


          ## Remediation

          Upgrade `node-uuid` to version 1.4.4 or greater.


          ## References

          - [GitHub Issue](https://github.com/broofa/node-uuid/issues/108)

          - [GitHub Issue 2](https://github.com/broofa/node-uuid/issues/122)
        functions: []
        from:
          - node-uuid@1.4.0
        package: node-uuid
        version: 1.4.0
        severity: medium
        exploitMaturity: no-known-exploit
        language: js
        packageManager: npm
        semver:
          vulnerable:
            - <1.4.4
        publicationTime: 2016-03-28T22:00:02.566000Z
        disclosureTime: 2016-03-28T21:29:30Z
        isUpgradable: true
        isPatchable: false
        isPinnable: false
        identifiers:
          ALTERNATIVE:
            - SNYK-JS-NODEUUID-10089
          CVE: []
          CWE:
            - CWE-330
          NSP:
            - 93
        credit:
          - Fedot Praslov
        CVSSv3: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
        cvssScore: 4.2
        patches:
          - comments: []
            id: patch:npm:node-uuid:20160328:0
            modificationTime: 2019-12-03T11:40:45.815314Z
            urls:
              - https://snyk-patches.s3.amazonaws.com/npm/node-uuid/20160328/node-uuid_20160328_0_0_616ad3800f35cf58089215f420db9654801a5a02.patch
            version: <=1.4.3 >=1.4.2
        upgradePath:
          - node-uuid@1.4.6
    Vulnerability5:
      title: Vulnerability5
      required:
        - id
        - url
        - title
        - type
        - description
        - functions
        - from
        - package
        - version
        - severity
        - exploitMaturity
        - language
        - packageManager
        - semver
        - publicationTime
        - disclosureTime
        - isUpgradable
        - isPatchable
        - isPinnable
        - identifiers
        - credit
        - CVSSv3
        - cvssScore
        - patches
        - upgradePath
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        title:
          type: string
        type:
          type: string
        description:
          type: string
        functions:
          type: array
          items:
            type: string
          description: ''
        from:
          type: array
          items:
            type: string
          description: ''
        package:
          type: string
        version:
          type: string
        severity:
          type: string
        exploitMaturity:
          type: string
        language:
          type: string
        packageManager:
          type: string
        semver:
          $ref: '#/components/schemas/Semver6'
        publicationTime:
          type: string
        disclosureTime:
          type: string
        isUpgradable:
          type: boolean
        isPatchable:
          type: boolean
        isPinnable:
          type: boolean
        identifiers:
          $ref: '#/components/schemas/Identifiers2'
        credit:
          type: array
          items:
            type: string
          description: ''
        CVSSv3:
          type: string
        cvssScore:
          type: number
        patches:
          type: array
          items:
            type: string
          description: ''
        upgradePath:
          type: array
          items:
            type: string
          description: ''
      example:
        id: SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
        url: http://localhost:34612/vuln/SNYK-GOLANG-GITHUBCOMSATORIGOUUID-72488
        title: Insecure Randomness
        type: vuln
        description: "## Overview\n[github.com/satori/go.uuid](https://github.com/satori/go.uuid) provides pure Go implementation of Universally Unique Identifier (UUID).\r\n\r\nAffected versions of this package are vulnerable to Insecure Randomness producing predictable `UUID` identifiers due to the limited number of bytes read when using the `g.rand.Read` function.\r\n \r\n## Disclosure Timeline\r\n* Jun 3th, 2018 - The vulnerability introduced by replacing the function `rand.Read()` with the function `g.rand.Read()` (https://github.com/satori/go.uuid/commit/0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c)\r\n* Mar 23th, 2018- An issue was reported.\r\n* Oct 16th, 2018 Issue fixed\r\n\r\n## Remediation\r\nA fix was merged into the master branch but not yet published.\n\n## References\n- [GitHub Commit](https://github.com/satori/go.uuid/commit/d91630c8510268e75203009fe7daf2b8e1d60c45)\n- [Github Issue](https://github.com/satori/go.uuid/issues/73)\n"
        functions: []
        from:
          - github.com/satori/go.uuid@v1.2.0
        package: github.com/satori/go.uuid
        version: v1.2.0
        severity: high
        exploitMaturity: no-known-exploit
        language: golang
        packageManager: golang
        semver:
          hashesRange:
            - '>=0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c <d91630c8510268e75203009fe7daf2b8e1d60c45'
          vulnerable:
            - =1.2.0
          vulnerableHashes:
            - c596ec57260fd2ad47b2ae6809d6890a2f99c3b2
            - 36e9d2ebbde5e3f13ab2e25625fd453271d6522e
            - f6920249aa08fc2a2c2e8274ea9648d0bb1e9364
            - 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c
        publicationTime: 2018-10-24T08:56:41Z
        disclosureTime: 2018-03-23T08:57:24Z
        isUpgradable: false
        isPatchable: false
        isPinnable: false
        identifiers:
          CVE: []
          CWE:
            - CWE-338
        credit:
          - josselin-c
        CVSSv3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
        cvssScore: 8.1
        patches: []
        upgradePath: []
    Vulnerability9:
      title: Vulnerability9
      required:
        - id
        - url
        - title
        - type
        - description
        - functions
        - from
        - package
        - version
        - severity
        - exploitMaturity
        - language
        - packageManager
        - semver
        - publicationTime
        - disclosureTime
        - isUpgradable
        - isPatchable
        - isPinnable
        - identifiers
        - credit
        - CVSSv3
        - cvssScore
        - patches
        - upgradePath
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        title:
          type: string
        type:
          type: string
        description:
          type: string
        functions:
          type: array
          items:
            type: string
          description: ''
        from:
          type: array
          items:
            type: string
          description: ''
        package:
          type: string
        version:
          type: string
        severity:
          type: string
        exploitMaturity:
          type: string
        language:
          type: string
        packageManager:
          type: string
        semver:
          $ref: '#/components/schemas/Semver2'
        publicationTime:
          type: string
        disclosureTime:
          type: string
        isUpgradable:
          type: boolean
        isPatchable:
          type: boolean
        isPinnable:
          type: boolean
        identifiers:
          $ref: '#/components/schemas/Identifiers10'
        credit:
          type: array
          items:
            type: string
          description: ''
        CVSSv3:
          type: string
        cvssScore:
          type: number
        patches:
          type: array
          items:
            type: string
          description: ''
        upgradePath:
          type: array
          items:
            type: string
          description: ''
      example:
        id: SNYK-RUBY-JSON-20000
        url: https://snyk.io/vuln/SNYK-RUBY-JSON-20000
        title: Denial of Service (DoS)
        type: vuln
        description: >
          ## Overview


          The [`json`](https://rubygems.org/gems/json) gem is a JSON implementation as a Ruby extension in C.

          Affected versions of this Gem contain an overflow condition. This is triggered when user-supplied input is not properly validated while handling specially crafted data. This can allow a remote attacker to cause a stack-based buffer overflow, resulting in a denial of service, or potentially allowing the [execution of arbitrary code](https://snyk.io/vuln/SNYK-RUBY-JSON-20209).


          ## Details

          Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.



          Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.



          One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.



          When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.



          Two common types of DoS vulnerabilities:



          * High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, [commons-fileupload:commons-fileupload](SNYK-JAVA-COMMONSFILEUPLOAD-30082).



          * Crash - An attacker sending crafted requests that could cause the system to crash. For Example,  [npm `ws` package](npm:ws:20171108)


          ## References

          - http://rubysec.com/advisories/OSVDB-101157
        functions: []
        from:
          - json@1.0.0
        package: json
        version: 1.0.0
        severity: high
        exploitMaturity: no-known-exploit
        language: ruby
        packageManager: rubygems
        semver:
          vulnerable:
            - < 1.1.0
        publicationTime: 2007-05-20T21:00:00Z
        disclosureTime: 2007-05-20T21:00:00Z
        isUpgradable: true
        isPatchable: false
        isPinnable: false
        identifiers:
          CVE: []
          CWE:
            - CWE-400
          OSVDB:
            - OSVDB-101157
        credit:
          - Unknown
        CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
        cvssScore: 7.5
        patches: []
        upgradePath:
          - json@1.1.0
    Vulnerability13:
      title: Vulnerability13
      required:
        - id
        - url
        - title
        - type
        - description
        - functions
        - from
        - package
        - version
        - severity
        - exploitMaturity
        - language
        - packageManager
        - semver
        - publicationTime
        - disclosureTime
        - isUpgradable
        - isPatchable
        - isPinnable
        - identifiers
        - credit
        - CVSSv3
        - cvssScore
        - patches
        - upgradePath
      type: object
      properties:
        id:
          type: string
        url:
          type: string
        title:
          type: string
        type:
          type: string
        description:
          type: string
        functions:
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Function1'
              - allOf:
                  - $ref: '#/components/schemas/Function11'
                  - example:
                      functionId:
                        className: org.jboss.netty.handler.codec.http.CookieEncoder
                        functionName: encode
                      version:
                        - '[3.10.0,3.10.2)'
                        - '[3.3.0,3.9.7)'
          description: ''
        from:
          type: array
          items:
            type: string
          description: ''
        package:
          type: string
        version:
          type: string
        severity:
          type: string
        exploitMaturity:
          type: string
        language:
          type: string
        packageManager:
          type: string
        semver:
          $ref: '#/components/schemas/Semver2'
        publicationTime:
          type: string
        disclosureTime:
          type: string
        isUpgradable:
          type: boolean
        isPatchable:
          type: boolean
        isPinnable:
          type: boolean
        identifiers:
          $ref: '#/components/schemas/Identifiers2'
        credit:
          type: array
          items:
            type: string
          description: ''
        CVSSv3:
          type: string
        cvssScore:
          type: number
        patches:
          type: array
          items:
            type: string
          description: ''
        upgradePath:
          type: array
          items:
            type: string
          description: ''
      example:
        id: SNYK-JAVA-COMNING-30317
        url: https://snyk.io/vuln/SNYK-JAVA-COMNING-30317
        title: Insufficient Verification of Data Authenticity
        type: vuln
        description: >
          ## Overview

          [`com.ning:async-http-client`](http://search.maven.org/#search%7Cga%7C1%7Ca%3A%22async-http-client%22)

          Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.


          ## References

          - [NVD](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7397)

          - [OSS Security](http://openwall.com/lists/oss-security/2014/08/26/1)

          - [GitHub Issue](https://github.com/AsyncHttpClient/async-http-client/issues/352)

          - [GitHub Commit](https://github.com/AsyncHttpClient/async-http-client/commit/dfacb8e05d0822c7b2024c452554bd8e1d6221d8)
        functions: []
        from:
          - net.databinder.dispatch:dispatch-core_2.11@0.11.2
          - com.ning:async-http-client@1.8.10
        package: com.ning:async-http-client
        version: 1.8.10
        severity: medium
        exploitMaturity: no-known-exploit
        language: java
        packageManager: maven
        semver:
          vulnerable:
            - '[,1.9.0)'
        publicationTime: 2017-03-28T08:29:28.375000Z
        disclosureTime: 2015-06-24T16:59:00Z
        isUpgradable: true
        isPatchable: false
        isPinnable: false
        identifiers:
          CVE:
            - CVE-2013-7397
          CWE:
            - CWE-345
        credit:
          - Unknown
        CVSSv3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
        cvssScore: 4.3
        patches: []
        upgradePath:
          - net.databinder.dispatch:dispatch-core_2.11@0.11.3
          - com.ning:async-http-client@1.9.11
    IntegrationCredentials:
      oneOf:
        - $ref: '#/components/schemas/AcrCredentials'
        - $ref: '#/components/schemas/ArtifactoryCrCredentials'
        - $ref: '#/components/schemas/AzureReposCredentials'
        - $ref: '#/components/schemas/BitbucketCloudCredentials'
        - $ref: '#/components/schemas/BitbucketServerCredentials'
        - $ref: '#/components/schemas/DigitalOceanCrCredentials'
        - $ref: '#/components/schemas/DockerHubCredentials'
        - $ref: '#/components/schemas/EcrCredentials'
        - $ref: '#/components/schemas/GcrCredentials'
        - $ref: '#/components/schemas/GitHubCredentials'
        - $ref: '#/components/schemas/GitHubCrCredentials'
        - $ref: '#/components/schemas/GitHubEnterpriseCredentials'
        - $ref: '#/components/schemas/GitLabCredentials'
        - $ref: '#/components/schemas/GitLabCrCredentials'
        - $ref: '#/components/schemas/GoogleArtifactCrCredentials'
        - $ref: '#/components/schemas/HarborCrCredentials'
        - $ref: '#/components/schemas/NexusCrCredentials'
        - $ref: '#/components/schemas/QuayCrCredentials'
tags:
  - name: Users
    description: For more information users and different user types see [Snyk docs](https://docs.snyk.io/introducing-snyk/snyks-core-concepts/groups-organizations-and-users#user-access-member-types).
  - name: Groups
    description: Groups can contain multiple organizations, allowing you to collaborate with multiple teams. For more information on Groups, organizations, and users see [Snyk docs](https://docs.snyk.io/introducing-snyk/snyks-core-concepts/groups-organizations-and-users).
  - name: Organizations
    description: For more information on organizations see [Snyk docs](https://docs.snyk.io/introducing-snyk/snyks-core-concepts/groups-organizations-and-users#snyk-organizations).
  - name: Integrations
    description: Integrations are connections to places where code lives. They can be configured from the [Integration page in the Settings area](https://app.snyk.io/manage/integrations) page.
  - name: Import Projects
    description: Import projects into Snyk. Projects can be Git repositories, Docker images, containers, configuration files and much more. See the [Projects and Targets documentation](https://docs.snyk.io/getting-started/introduction-to-snyk-projects#targets) for more information. A typical import would start with requesting a target to be processed and then polling the Import Job API for further details on completion and resulting Snyk projects.
  - name: Projects
    description: A project is a package that is actively tracked by Snyk.
  - name: Dependencies
    description: >-
      Dependencies are packages/modules that your projects depend on.


      Current rate limit is up to 150 requests per minute, per user.

      For more information about rate-limiting see: [https://docs.snyk.io/snyk-api/v1-api#rate-limiting](https://docs.snyk.io/snyk-api/v1-api#rate-limiting)
  - name: Licenses
    description: >-
      The licenses which the packages/modules in your projects use.


      > **Note:** When you import or update projects, changes will be reflected on the endpoint results after a ten-second delay.
  - name: Entitlements
    description: Entitlements are specific abilities an organization has enabled.
  - name: Test
    description: Test a package for issues with Snyk.
  - name: Monitor
    description: >-
      Snyk constantly discloses new vulnerabilities. Monitor gives you a way to regularly test your project for

      new vulnerabilities and be alerted when action is required in order to keep your project secure.
  - name: Reporting API
    description: >-
      **Note:** The endpoints in this category only support Snyk legacy reporting, not the latest release. As such, they are **not** available in regions such as **single-tenant** or **multi-tenant EU/AU** and you can instead use [the Issues REST API](https://apidocs.snyk.io/#tag--Issues).


      The reporting API powers our reports section.


      With it you can find answers to questions like how many issues your organisation has, or how many tests have been conducted in a given time frame.


      Current rate limit is up to 70 requests per minute, per user.

      All requests above the limit will get a response with status code `429` - `Too many requests` until requests stop for the duration of the rate-limiting interval (currently a minute).

      For more information about rate-limiting see: [https://docs.snyk.io/snyk-api/v1-api#rate-limiting](https://docs.snyk.io/snyk-api/v1-api#rate-limiting)
  - name: Webhooks
    description: >-
      ## Intro


      > Warning: the webhooks feature is currently in beta. While in this status, we may change the API and the structure of webhook payloads at any time, without notice.


      Webhooks allow you to be notified of events taking place in the Snyk system and react to changes in your projects.


      Webhooks associate an event type with a URL. When something triggers that event type, Snyk sends an HTTP POST request to the URL with a payload containing information about the event. Currently supported targets/scan types are Open Source and container.


      ## Who can access this feature?


      Only Business and Enterprise customers.


      ## Configuring webhooks


      Webhooks can be configured using our API at organization level, by organization admins.
