fix: security vulnerabilities (Trust scan a717d36b)

[Jaden-JJH]

Security Fixes by Trust Security

Scan ID: a717d36b-ab8b-4137-8650-e97b1c2af07c
Score: 1/100 (Grade F)

Fixed Vulnerabilities (34)

• [CRITICAL] Arbitrary Code Execution in underscore (package.json)
• [CRITICAL] Identified a Private Key, which may compromise cryptographic security and sensitive data encryption. (artifacts/cert/server.key)
• [HIGH] Race Condition in Grunt (package.json)
• [HIGH] Denial of Service in mongodb (package.json)
• [HIGH] body-parser vulnerable to denial of service when url encoding is enabled (package.json)
• [HIGH] Detected Private Key (CWE-798) (artifacts/cert/server.key)
• [HIGH] Detected Bcrypt Hash (CWE-798) (artifacts/db-reset.js)
• [HIGH] Code String Concat (CWE-95) (app/routes/contributions.js)
• [HIGH] Regular Expression Denial of Service in marked (package.json)
• [HIGH] Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (config/env/development.js)
• [HIGH] Arbitrary Code Execution in grunt (package.json)
• [HIGH] Inefficient Regular Expression Complexity in marked (package.json)
• [HIGH] Arbitrary local file read vulnerability during template rendering (package.json)
• [HIGH] Inefficient Regular Expression Complexity in marked (package.json)
• [LOW] express vulnerable to XSS via response.redirect() (package.json)
• [LOW] Express Check Csurf Middleware Usage (CWE-352) (server.js)
• [MEDIUM] Eval Detected (CWE-95) (app/routes/contributions.js)
• [MEDIUM] Express Cookie Session Default Name (CWE-522) (server.js)
• [MEDIUM] Django No Csrf Token (CWE-352) (app/views/benefits.html)
• [MEDIUM] Express Cookie Session No Httponly (CWE-522) (server.js)
• [MEDIUM] Using Http Server (CWE-319) (server.js)
• [MEDIUM] Plaintext Http Link (CWE-319) (app/views/tutorial/a2.html)
• [MEDIUM] No New Privileges (CWE-732) (docker-compose.yml)
• [MEDIUM] Writable Filesystem Service (CWE-732) (docker-compose.yml)
• [MEDIUM] Express Cookie Session No Domain (CWE-522) (server.js)
• [MEDIUM] Express Cookie Session No Path (CWE-522) (server.js)
• [MEDIUM] Express.js Open Redirect in malformed URLs (package.json)
• [MEDIUM] Express Cookie Session No Expires (CWE-522) (server.js)
• [MEDIUM] Marked allows Regular Expression Denial of Service (ReDoS) attacks (package.json)
• [MEDIUM] Express Cookie Session No Secure (CWE-522) (server.js)
• [MEDIUM] Sanitization bypass using HTML Entities in marked (package.json)
• [MEDIUM] Path Traversal in Grunt (package.json)
• [MEDIUM] Express Open Redirect (CWE-601) (app/routes/index.js)
• [MEDIUM] Marked vulnerable to XSS from data URIs (package.json)

---

Generated by Trust Security