gitsafehub
github.com/greyireland/symphony ↗

greyireland/symphony

scanned 2026-08-06 · git 43c1d8f
3 of 6 checks flagged a security issue
🔴 Needs attention
Only 5 of 6 checks finished — treat this as provisional. Re-check ↻

Informational scan, not a security audit. How this is computed.

Leaked secrets2Vulnerable dependencies40Known OSS vulnerabilities263Risky code patterns✓Malicious dependencies✓Project health—

Security checks

Leaked secrets — Gitleaksⓘ 2 found

API keys, passwords or tokens committed into the repo.

  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    src/main/webapp/halt.html:66
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.
  • Worth fixing generic-api-key Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    src/main/webapp/skins/mobile/index.ftl:134
    A credential (key, password or token) appears in your code. Fix: Remove it, rotate the key, and load it from an environment variable instead.

via Gitleaks v8.21.2 · MIT

Vulnerable dependencies — Trivyⓘ 40 found · 2 serious

Packages you depend on that have known security holes (CVEs).

  • Serious CVE-2023-45311 Code injection in fsevents
    yarn.lock
    A package you depend on has a known security hole (CVE-2023-45311). Fix: Update that package to its patched version.
  • Serious CVE-2026-59873 tar: node-tar: Denial of Service via crafted gzip bomb
    yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Worth fixing CVE-2024-47554 apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader
    pom.xml
    A package you depend on has a known security hole (CVE-2024-47554). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6
    pom.xml
    A package you depend on has a known security hole (CVE-2021-29425). Fix: Update that package to its patched version.
  • Worth fixing CVE-2023-26464 log4j1-socketappender: DoS via hashmap logging
    pom.xml
    A package you depend on has a known security hole (CVE-2023-26464). Fix: Update that package to its patched version.
  • Worth fixing CVE-2018-3258 mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018)
    pom.xml
    A package you depend on has a known security hole (CVE-2018-3258). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-2692 mysql-connector-java: privilege escalation in MySQL connector
    pom.xml
    A package you depend on has a known security hole (CVE-2019-2692). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-2471 mysql-connector-java: unauthorized access to critical
    pom.xml
    A package you depend on has a known security hole (CVE-2021-2471). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-21363 mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors
    pom.xml
    A package you depend on has a known security hole (CVE-2022-21363). Fix: Update that package to its patched version.
  • Worth fixing CVE-2019-9142 Moderate severity vulnerability that affects org.b3log:symphony
    pom.xml
    A package you depend on has a known security hole (CVE-2019-9142). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-29631 Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vul ...
    pom.xml
    A package you depend on has a known security hole (CVE-2022-29631). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-37714 jsoup: Crafted input may cause the jsoup HTML and XML parser to get stuck
    pom.xml
    A package you depend on has a known security hole (CVE-2021-37714). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-36033 jsoup: The jsoup cleaner may incorrectly sanitize crafted XSS attempts if SafeList.preserveRelativeLinks is enabled
    pom.xml
    A package you depend on has a known security hole (CVE-2022-36033). Fix: Update that package to its patched version.
  • Worth fixing CVE-2017-18640 snakeyaml: Billion laughs attack via alias feature
    pom.xml
    A package you depend on has a known security hole (CVE-2017-18640). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-1471 SnakeYaml: Constructor Deserialization Remote Code Execution
    pom.xml
    A package you depend on has a known security hole (CVE-2022-1471). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-25857 snakeyaml: Denial of Service due to missing nested depth limitation for collections
    pom.xml
    A package you depend on has a known security hole (CVE-2022-25857). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-38749 snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode
    pom.xml
    A package you depend on has a known security hole (CVE-2022-38749). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-38750 snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject
    pom.xml
    A package you depend on has a known security hole (CVE-2022-38750). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-38751 snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match
    pom.xml
    A package you depend on has a known security hole (CVE-2022-38751). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-38752 snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode
    pom.xml
    A package you depend on has a known security hole (CVE-2022-38752). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-41854 dev-java/snakeyaml: DoS via stack overflow
    pom.xml
    A package you depend on has a known security hole (CVE-2022-41854). Fix: Update that package to its patched version.
  • Worth fixing CVE-2020-7788 nodejs-ini: Prototype pollution via malicious INI file
    yarn.lock
    A package you depend on has a known security hole (CVE-2020-7788). Fix: Update that package to its patched version.
  • Worth fixing CVE-2022-25883 nodejs-semver: Regular expression denial of service
    yarn.lock
    A package you depend on has a known security hole (CVE-2022-25883). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-32803 nodejs-tar: Insufficient symlink protection allowing arbitrary file creation and overwrite
    yarn.lock
    A package you depend on has a known security hole (CVE-2021-32803). Fix: Update that package to its patched version.
  • Worth fixing CVE-2021-32804 nodejs-tar: Insufficient absolute path sanitization allowing arbitrary file creation and overwrite
    yarn.lock
    A package you depend on has a known security hole (CVE-2021-32804). Fix: Update that package to its patched version.
… 15 more not shown

via Trivy v0.70.0 · Apache-2.0

Known OSS vulnerabilities — OSV-Scannerⓘ 263 found · 26 serious

Your dependencies cross-checked against the OSV vulnerability database.

  • Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
  • Serious MAL-2023-462 Malicious code in fsevents (npm)
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Serious GHSA-8r6j-v8pm-fqw3 Code injection in fsevents
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2023-45311). Fix: Update that package to its patched version.
  • Serious GHSA-896r-f27r-55mw json-schema is vulnerable to Prototype Pollution
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2021-3918). Fix: Update that package to its patched version.
  • Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
  • Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
  • Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious GHSA-fhjf-83wg-r2j9 Prototype Pollution in mixin-deep
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2019-10746). Fix: Update that package to its patched version.
  • Serious GHSA-4g88-fppr-53pp Prototype Pollution in set-value
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2019-10747). Fix: Update that package to its patched version.
  • Serious GHSA-4g88-fppr-53pp Prototype Pollution in set-value
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2019-10747). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/package-lock.json
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
  • Serious GHSA-fjxv-7rqg-78g4 form-data uses unsafe random function in form-data for choosing boundary
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2025-7783). Fix: Update that package to its patched version.
  • Serious MAL-2023-462 Malicious code in fsevents (npm)
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole. Fix: Update that package to its patched version.
  • Serious GHSA-8r6j-v8pm-fqw3 Code injection in fsevents
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2023-45311). Fix: Update that package to its patched version.
  • Serious GHSA-896r-f27r-55mw json-schema is vulnerable to Prototype Pollution
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2021-3918). Fix: Update that package to its patched version.
  • Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
  • Serious GHSA-jf85-cpcp-j695 Prototype Pollution in lodash
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2019-10744). Fix: Update that package to its patched version.
  • Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious GHSA-xvch-5gv4-984h Prototype Pollution in minimist
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2021-44906). Fix: Update that package to its patched version.
  • Serious GHSA-fhjf-83wg-r2j9 Prototype Pollution in mixin-deep
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2019-10746). Fix: Update that package to its patched version.
  • Serious GHSA-4g88-fppr-53pp Prototype Pollution in set-value
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2019-10747). Fix: Update that package to its patched version.
  • Serious GHSA-4g88-fppr-53pp Prototype Pollution in set-value
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2019-10747). Fix: Update that package to its patched version.
  • Serious GHSA-23hp-3jrh-7fpw node-tar: Decompression/parse DoS via unlimited input
    /workdirs/scan-a4b68b1c-4be7-490d-8d1a-69570a920dd0/yarn.lock
    A package you depend on has a known security hole (CVE-2026-59873). Fix: Update that package to its patched version.
… 238 more not shown

via OSV-Scanner v1.9.2 · Apache-2.0

Risky code patterns — Semgrepⓘ none found ✓

Code that can be exploited: injection, hardcoded credentials and similar.

Nothing found by this check. ✓

via Semgrep v1.147.0 · LGPL-2.1

Malicious dependencies — Guarddogⓘ none found ✓

Packages that look intentionally malicious: typosquats, sneaky install scripts.

Nothing found by this check. ✓

via Guarddog v2.10.0 · Apache-2.0

Project health

A signal about how the project is maintained — not a vulnerability in your code. It doesn’t affect the verdict above.

Project health — OpenSSF Scorecardⓘ didn’t run

Maintenance & supply-chain hygiene. A signal about the project, not a vulnerability in your code.

This check didn’t finish — that’s not the same as “clean.” Try Check again above.

via OpenSSF Scorecard · Apache-2.0

About these results. Six open-source checks ran in parallel; every finding is tagged with the tool that produced it. The verdict follows a published rule. False positives and false negatives are normal — a clean scan does not mean the code is secure, and a red verdict does not mean the project is compromised.