Skip to content

Commit 106b394

Browse files
afsmeiraafsmeira
committed
fix: Add expected vulnerabilities to tests
1 parent 02f624b commit 106b394

File tree

4 files changed

+66
-6
lines changed

4 files changed

+66
-6
lines changed

‎docs/multiple-tests/all-patterns/results.xml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,18 @@
2727
message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2025-68161: Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification) (update to 2.25.3)"
2828
severity="warning"
2929
/>
30+
<error
31+
source="vulnerability_medium"
32+
line="1"
33+
message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34480: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/ma ...) (update to 2.25.4)"
34+
severity="warning"
35+
/>
36+
<error
37+
source="vulnerability_medium"
38+
line="1"
39+
message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34477: Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration) (update to 2.25.4)"
40+
severity="warning"
41+
/>
3042
<error
3143
source="vulnerability_critical"
3244
line="2"

‎docs/multiple-tests/pattern-vulnerability-critical/results.xml‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,13 @@
4343
<error
4444
source="vulnerability_critical"
4545
line="14"
46-
message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF) (update to 1.15.0)"
46+
message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization) (update to 1.15.0)"
47+
severity="error"
48+
/>
49+
<error
50+
source="vulnerability_critical"
51+
line="14"
52+
message="Insecure dependency npm/axios@0.21.0 (CVE-2026-40175: Axios is a promise based HTTP client for the browser and Node.js. Prio ...) (update to 1.15.0)"
4753
severity="error"
4854
/>
4955
</file>
@@ -52,7 +58,13 @@
5258
<error
5359
source="vulnerability_critical"
5460
line="5"
55-
message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: Axios has a NO_PROXY Hostname Normalization Bypass Leads to SSRF) (update to 1.15.0)"
61+
message="Insecure dependency npm/axios@0.21.0 (CVE-2025-62718: axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization) (update to 1.15.0)"
62+
severity="error"
63+
/>
64+
<error
65+
source="vulnerability_critical"
66+
line="5"
67+
message="Insecure dependency npm/axios@0.21.0 (CVE-2026-40175: Axios is a promise based HTTP client for the browser and Node.js. Prio ...) (update to 1.15.0)"
5668
severity="error"
5769
/>
5870
</file>

‎docs/multiple-tests/pattern-vulnerability-high/results.xml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,18 @@
112112
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-25679: net/url: Incorrect parsing of IPv6 host literals in net/url) (update to 1.25.8)"
113113
severity="high"
114114
/>
115+
<error
116+
source="vulnerability_high"
117+
line="5"
118+
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32280: During chain building, the amount of work that is done is not correctl ...) (update to 1.25.9)"
119+
severity="high"
120+
/>
121+
<error
122+
source="vulnerability_high"
123+
line="5"
124+
message="Insecure dependency golang/stdlib@v1.21.4 (CVE-2026-32282: golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root) (update to 1.25.9)"
125+
severity="high"
126+
/>
115127
</file>
116128

117129
<file name="javascript/package-lock.json">

‎docs/multiple-tests/pattern-vulnerability-medium/results.xml‎

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,18 @@
239239
message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2021-44832: log4j-core: remote code execution via JDBC Appender) (update to 2.17.1)"
240240
severity="warning"
241241
/>
242+
<error
243+
source="vulnerability_medium"
244+
line="1"
245+
message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34480: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/ma ...) (update to 2.25.4)"
246+
severity="warning"
247+
/>
248+
<error
249+
source="vulnerability_medium"
250+
line="1"
251+
message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34477: Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration) (update to 2.25.4)"
252+
severity="warning"
253+
/>
242254
</file>
243255

244256
<file name="java/pom.xml">
@@ -254,6 +266,18 @@
254266
message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2025-68161: Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification) (update to 2.25.3)"
255267
severity="warning"
256268
/>
269+
<error
270+
source="vulnerability_medium"
271+
line="14"
272+
message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34480: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/ma ...) (update to 2.25.4)"
273+
severity="warning"
274+
/>
275+
<error
276+
source="vulnerability_medium"
277+
line="14"
278+
message="Insecure dependency maven/org.apache.logging.log4j/log4j-core@2.17.0 (CVE-2026-34477: Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration) (update to 2.25.4)"
279+
severity="warning"
280+
/>
257281
</file>
258282

259283
<file name="javascript/package-lock.json">
@@ -271,8 +295,8 @@
271295
/>
272296
<error
273297
source="vulnerability_medium"
274-
line="14"
275-
message="Insecure dependency npm/axios@0.21.0 (CVE-2026-39865: axios: Axios: Denial of Service via HTTP/2 session cleanup logic state corruption) (update to 1.13.2)"
298+
line="23"
299+
message="Insecure dependency npm/follow-redirects@1.15.6 (GHSA-r4q5-vmmm-2653: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets) (update to 1.16.0)"
276300
severity="warning"
277301
/>
278302
</file>
@@ -292,8 +316,8 @@
292316
/>
293317
<error
294318
source="vulnerability_medium"
295-
line="5"
296-
message="Insecure dependency npm/axios@0.21.0 (CVE-2026-39865: axios: Axios: Denial of Service via HTTP/2 session cleanup logic state corruption) (update to 1.13.2)"
319+
line="12"
320+
message="Insecure dependency npm/follow-redirects@1.15.6 (GHSA-r4q5-vmmm-2653: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets) (update to 1.16.0)"
297321
severity="warning"
298322
/>
299323
</file>

0 commit comments

Comments
 (0)