Both open source and enterprise code projects are currently being affected by some security-flawed components from the open source community. The Open Source Security Survey report from Synopsys OSSRA reports 2021 shows that an average of 55 security-deficient components are introduced per project, and an average of 161 vulnerabilities are resulting in each project being affected by these flawed open source components.The OSCS security community pays attention to a number of open source projects and proactively detects and prompts projects for risks:A reminder to the authors and contributors of these open source projects that are being affected by open source components with security flawsTipsStar & Fork Developers of these projects, you may also be affected by these open source components with security flaws
Both open source and enterprise code projects are currently being affected by some security-flawed components from the open source community. The Open Source Security Survey report from Synopsys OSSRA reports 2021 shows that an average of 55 security-deficient components are introduced per project, and an average of 161 vulnerabilities are resulting in each project being affected by these flawed open source components.The OSCS security community pays attention to a number of open source projects and proactively detects and prompts projects for risks:A reminder to the authors and contributors of these open source projects that are being affected by open source components with security flawsTipsStar & Fork Developers of these projects, you may also be affected by these open source components with security flaws
Hello, because bdring/FluidNC is being watched by OSCS and is affected by components with security flaws, I dare to remind you by email. If the oscs security community information does not help you, click Unsubscribe, we will mark it as temporarily unconcerned, and you will not be prompted again in the future. The bdring/FluidNC project introduced a total of 5 vulnerable defective components, and here are some of the key pieces of information:Full report: https://www.oscs1024.com/cd/1530425986133499904?sign=adb097d8&report=1
A reminder to the authors and contributors of these open source projects that are being affected by open source components with security flaws
TipsStar & Fork Developers of these projects, you may also be affected by these open source components with security flaws
Vulnerability title: Takayuki Sato copy-props security vulnerability
Description: Takayuki Sato copy-props is an open source application system of Takayuki Sato. Used to copy properties deeply between two objects. copy-props before 2.0.5 has a security vulnerability due to susceptibility to prototype contamination.
CVE Number: CVE-2020-28503
National Vulnerability Database Information:
Scope of Influence: (∞, 2.0.5).
Minimum fixed version: 2.0.5
Component ingestion path: embedded4ESP3D@->copy-props@2.0.4
Vulnerability Details: [https://www.oscs1024.com/hd/MPS-2021-3446](https://sctrack.sendcloud.net/track/click/eyJuZXRlYXNlIjogImZhbHNlIiwgIm1haWxsaXN0X2lkIjogMCwgInRhc2tfaWQiOiAiIiwgImVtYWlsX2lkIjogIjE2NjMxNDg3NTA5MzVfMTYwNzcwXzIzMDc3XzQxMzUuc2MtMTBfOV81MV8xMjItaW5ib3VuZDAkamltZGFza2FsYWtpczAxQG1zbi5jb20iLCAic2lnbiI6ICI3YWFkMDg0MmMyMDk5Y2I5YTJkZTM2NDVkZmVkOGMwNiIsICJ1c2VyX2hlYWRlcnMiOiB7fSwgImxhYmVsIjogIjIyMzE0MDYxIiwgInRyYWNrX2RvbWFpbiI6ICJzY3RyYWNrLnNlbmRjbG91ZC5uZXQiLCAicmVhbF90eXBlIjogIiIsICJsaW5rIjogImh0dHBzJTNBLy93d3cub3NjczEwMjQuY29tL2hkL01QUy0yMDIxLTM0NDYlM0ZzJTNEbSIsICJvdXRfaXAiOiAiMTA2Ljc1LjEwLjExMiIsICJjb250ZW50X3R5cGUiOiAzLCAidXNlcl9pZCI6IDE2MDc3MCwgIm92ZXJzZWFzIjogImZhbHNlIiwgImNhdGVnb3J5X2lkIjogMjU3MzQ3fQ==.html)
有缺陷的组件：underscore@1.5.2 – 间接介绍
Vulnerability Title: Npm underscore code injection vulnerability
Impact Description: Npm underscore is an application of Npm Corporation in the United States. A JavaScript utility with libraries that provides support for common suspicious functions without having to extend any core JavaScript objects. a code injection vulnerability exists in underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 that could be exploited by an attacker to easily execute arbitrary code through template functions.
CVE number: CVE-2021-23358
National Vulnerability Database Information:
Scope of influence: [1.13.0-0, 1.13.0-2), [1.3.2, 1.12.1)
Minimum fix versions: 1.13.0-2, 1.12.1
Component ingestion path: embedded4ESP3D@->gulp-smoosher@0.0.9->cheerio@0.13.1->underscore@1.5.2
Vulnerability details: [https://www.oscs1024.com/hd/MPS-2021-3658](https://sctrack.sendcloud.net/track/click/eyJuZXRlYXNlIjogImZhbHNlIiwgIm1haWxsaXN0X2lkIjogMCwgInRhc2tfaWQiOiAiIiwgImVtYWlsX2lkIjogIjE2NjMxNDg3NTA5MzVfMTYwNzcwXzIzMDc3XzQxMzUuc2MtMTBfOV81MV8xMjItaW5ib3VuZDAkamltZGFza2FsYWtpczAxQG1zbi5jb20iLCAic2lnbiI6ICIxZDE1MWExOThhZWZiMDY5MDc1NjU2NzJjODIzZDE1YSIsICJ1c2VyX2hlYWRlcnMiOiB7fSwgImxhYmVsIjogIjIyMzE0MDYxIiwgInRyYWNrX2RvbWFpbiI6ICJzY3RyYWNrLnNlbmRjbG91ZC5uZXQiLCAicmVhbF90eXBlIjogIiIsICJsaW5rIjogImh0dHBzJTNBLy93d3cub3NjczEwMjQuY29tL2hkL01QUy0yMDIxLTM2NTglM0ZzJTNEbSIsICJvdXRfaXAiOiAiMTA2Ljc1LjEwLjExMiIsICJjb250ZW50X3R5cGUiOiAzLCAidXNlcl9pZCI6IDE2MDc3MCwgIm92ZXJzZWFzIjogImZhbHNlIiwgImNhdGVnb3J5X2lkIjogMjU3MzQ3fQ==.html)
.jpg "问题：我收到邮件说这是某种易受攻击的软件 #611"){kind=avatar}
控制板
呐
董事会供应商的帮助
机器描述
呐
配置文件
na启动消息
用户界面软件
呐
发生了什么？
我为 fluidnc 项目加了星标，大约一分钟后我收到了这封电子邮件。
开发者jimmys01，您好：
开源和企业代码项目目前都受到来自开源社区的一些存在安全缺陷的组件的影响。Synopsys OSSRA 报告 2021 的开源安全调查报告显示，每个项目平均引入 55 个安全缺陷组件，平均 161 个漏洞导致每个项目受到这些有缺陷的开源组件的影响。
OSCS安全社区关注多个开源项目，主动检测并提示项目风险：
您好，因为bdring/FluidNC正在被OSCS监控，受到存在安全漏洞的组件的影响，所以敢邮件提醒您。如果oscs安全社区信息对您没有帮助，请点击退订，我们会标记为暂时不关注，以后不会再提示您。
bdring/FluidNC项目一共引入了5个易受攻击的缺陷组件，以下是其中的一些关键信息：
完整报告：https ://www.oscs1024.com/cd/1530425986133499904?sign=adb097d8&report=1
有缺陷的组件：copy-props@2.0.4 – 直接摄取
有缺陷的组件：underscore@1.5.2 – 间接介绍
Oscs 安全社区受到尊重
祝您工作顺利，生活愉快
其他信息
只是报告我不在乎回复，
感谢 marvelus 固件！