Generated on Apr 22, 2024 via pnpm

Npm

Home

saml2-js 1.12.2

SAML 2.0 node helpers

saml

node

Package summary

issues

licenses

Package created

4 Apr 2014

Version published

8 Aug 2017

Maintainers

Total deps

Direct deps

License

UNKNOWN

Issues

3 critical severity issues

critical

ejs@2.7.4

ejs template injection vulnerability

Recommendation: Upgrade to version 3.1.7 or later

via: xml-encryption@0.11.2

xmldom@0.1.19

xmldom allows multiple root nodes in a DOM

Recommendation: None

via: xml-crypto@0.10.1 & others

saml2-js@1.12.2

Package has no specified license

Recommendation: Check the package code and files for license information

via: saml2-js@1.12.2

Collapse

Expand

9 high severity issues

high

xml-crypto@0.10.1

xml-crypto's HMAC-SHA1 signatures can bypass validation via key confusion

Recommendation: Upgrade to version 2.0.0 or later

via: xml-crypto@0.10.1

node-forge@0.7.6

Prototype Pollution in node-forge

Recommendation: Upgrade to version 0.10.0 or later

via: xml-encryption@0.11.2

node-forge@0.7.6

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: xml-encryption@0.11.2

node-forge@0.7.6

Improper Verification of Cryptographic Signature in node-forge

Recommendation: Upgrade to version 1.3.0 or later

via: xml-encryption@0.11.2

xmldom@0.1.19

Package uses an invalid SPDX license ("LGPL")

Recommendation: Validate that the package complies with your license policy

via: xml-crypto@0.10.1

ejs@2.7.4

Package uses postinstall script: "node ./postinstall.js"

via: xml-encryption@0.11.2

lodash-node@2.4.1

Deprecated package

via: xmlbuilder@2.2.1

xmldom@0.1.19

Deprecated package

via: xml-crypto@0.10.1

xmldom@0.1.31

Deprecated package

via: xml-encryption@0.11.2 & others

Collapse

Expand

9 moderate severity issues

moderate

saml2-js@1.12.2

Authentication Bypass in saml2-js

Recommendation: Upgrade to version 2.0.5 or later

via: saml2-js@1.12.2

saml2-js@1.12.2

Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js

Recommendation: Upgrade to version 1.12.4 or later

via: saml2-js@1.12.2

saml2-js@1.12.2

Authentication Bypass in saml2-js

Recommendation: Upgrade to version 2.0.5 or later

via: saml2-js@1.12.2

saml2-js@1.12.2

Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js

Recommendation: Upgrade to version 1.12.4 or later

via: saml2-js@1.12.2

node-forge@0.7.6

Improper Verification of Cryptographic Signature in `node-forge`

Recommendation: Upgrade to version 1.3.0 or later

via: xml-encryption@0.11.2

xmldom@0.1.19

Misinterpretation of malicious XML input

Recommendation: Upgrade to version 0.5.0 or later

via: xml-crypto@0.10.1 & others

node-forge@0.7.6

Open Redirect in node-forge

Recommendation: Upgrade to version 1.0.0 or later

via: xml-encryption@0.11.2

xmldom@0.1.19

Misinterpretation of malicious XML input

Recommendation: None

via: xml-crypto@0.10.1 & others

xml2js@0.4.23

xml2js is vulnerable to prototype pollution

Recommendation: Upgrade to version 0.5.0 or later

via: xml2js@0.4.23

Collapse

Expand

4 low severity issues

low

node-forge@0.7.6

Prototype Pollution in node-forge debug API.

Recommendation: Upgrade to version 1.0.0 or later

via: xml-encryption@0.11.2

node-forge@0.7.6

Prototype Pollution in node-forge util.setPath API

Recommendation: Upgrade to version 0.10.0 or later

via: xml-encryption@0.11.2

node-forge@0.7.6

URL parsing in node-forge could lead to undesired behavior.

Recommendation: Upgrade to version 1.0.0 or later

via: xml-encryption@0.11.2

xmldom@0.1.19

Package uses a license that is not OSI approved ("LGPL")

Recommendation: Read and validate the license terms

via: xml-crypto@0.10.1

Collapse

Expand

Licenses

MIT License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

Cannot

hold-liable

Must

include-copyright

include-license

13 Packages, Including:

async@2.6.4

debug@2.6.9

lodash-node@2.4.1

lodash@4.17.21

ms@2.0.0

underscore@1.13.6

xml-crypto@0.10.1

xml-encryption@0.11.2

xml2js@0.4.23

xmlbuilder@11.0.1

xmlbuilder@2.2.1

xpath.js@1.1.0

xpath@0.0.27

Apache License 2.0

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

sublicense

private-use

use-patent-claims

place-warranty

Cannot

hold-liable

use-trademark

Must

include-copyright

include-license

state-changes

include-notice

1 Packages, Including:

ejs@2.7.4

(BSD-3-Clause OR GPL-2.0)

Permissive

1 Packages, Including:

node-forge@0.7.6

N/A

1 Packages, Including:

saml2-js@1.12.2

ISC License

Permissive

OSI Approved

This is a human-readable summary of (and not a substitute for) the license. Disclaimer.

Can

commercial-use

modify

distribute

Cannot

hold-liable

Must

include-copyright

include-license

1 Packages, Including:

sax@1.3.0

LGPL

Invalid

Not OSI Approved

1 Packages, Including:

xmldom@0.1.19

(LGPL-2.0 or MIT)

Permissive

1 Packages, Including:

xmldom@0.1.31

Direct Dependencies

All Dependencies CSV

ⓘ This is a list of saml2-js 's direct dependencies. Data on all dependencies, including transitive ones, is available via CSV download.

Name	Version	Size	License	Type	Vulnerabilities
async	2.6.4	120.04 kB	MIT	prod
debug	2.6.9	16.13 kB	MIT	prod
underscore	1.13.6	211.5 kB	MIT	prod
xml-crypto	0.10.1	17.23 kB	MIT	prod	1 3 2 1
xml-encryption	0.11.2	29.22 kB	MIT	prod	2 5 4 3
xml2js	0.4.23	12.64 kB	MIT	prod	1
xmlbuilder	2.2.1	8.44 kB	MIT	prod	1
xmldom	0.1.31	19.5 kB	(LGPL-2.0 or MIT)	prod	1 1 2