Questions tagged [snyk]

Snyk is a service that analyzes your code to help find and fix security vulnerabilities in your applications, containers, infrastructure-as-code, and cloud environments.

Filter by
Sorted by
Tagged with
1 vote
1 answer
141 views

NPM Installing dependency I do not want and it is a vulnerability, how can I remove it?

I am currently seeing a vulnerability reporting on my docker image for a package I do not want. The package is found here: https://snyk.io/advisor/npm-package/monorepo-symlink-test In my node_modules ...
user68288's user avatar
  • 722
1 vote
1 answer
51 views

npm - a package's 6th level dependency is shown to be using outdated version by snyk

In my node.js project, I have dependency on packageA. Since this package is archived now, I had to override one of it's dependencies (not sure if this is relevant). My package.json looks like this- ......
John Reese's user avatar
3 votes
1 answer
126 views

How to run multiple Snyk commands in a GitHub Actions workflow?

I'm setting up a GitHub Actions workflow to perform security scans on my Node.js project using Snyk. I want to run multiple Snyk commands within the same job of the workflow, but I'm not sure how to ...
sujeet's user avatar
  • 3,510
1 vote
1 answer
72 views

How to address CWE-502 for Swift's Codable

Snyk.io has alerted me to a CWE-502 issue with a Swift class that implements Codable. Deserialization of untrusted data (CWE-502), is when the application deserializes untrusted data without ...
Scott McKenzie's user avatar
1 vote
1 answer
67 views

'snyk-scm-contributors-count' is not recognized as an internal or external command, operable program or batch file

I have Synk CLI installed on my local and yet snyk-scm-contributors-count is not found. I haven't found the correct documentation for it. Trying to see if anyone else having similar issues.
Sai Teja Makani's user avatar
2 votes
1 answer
101 views

Can snyk be configured to ignore all issues for a particular maven dependency?

I would like to clarify some moments regarding snyk ignore. Is it possible to configure .snyk file to ignore all kinds of issues for a particular maven dependency. https://docs.snyk.io/snyk-cli/...
John Smith's user avatar
1 vote
0 answers
109 views

curl vulnerabilities reported against a container image that runs a dotnetcore process [closed]

We're running a dotnetcore web application on a Debian 11.7-slim image in AWS ECS+Fargate. Snyk Container is reporting that curl 7.74 is present on the image and suffers from "CVE-2023-23914 - ...
Peter McEvoy's user avatar
  • 2,816
3 votes
3 answers
221 views

How to sanitize api response server side?

I have an Express Request Handler that takes a request, which includes user form input (email), makes a request to another one of my (trusted) endpoints (via newFunctionWithRequest), and then returns ...
grabury's user avatar
  • 4,847
1 vote
1 answer
41 views

Snyk issue status in API - ignore, open, resolve

Is there any way in Snyk to run an API query for getting the status of a specific issue (ignored, open, resolved, etc.)?
Jonathan Gruber's user avatar
2 votes
1 answer
80 views

Does Snyk offer management for Open Source License Compliance? If yes, is it possible to generate reports based on the licences being used?

Does Snyk offer management for Open Source License Compliance? If yes, is it possible to generate reports based on the licences being used? I was wondering if Snyk is able to offer any management and ...
Miklos Csecsi's user avatar
4 votes
0 answers
60 views

Retrieving Snyk's vulnerability alerts in Splunk

How could one retrieve Snyk's vulnerabilities into Splunk? I am thinking the Splunk OpenTelemetry Collector could be a good integration point, but willing to know if someone has a parser before ...
Jonathan Gruber's user avatar
2 votes
1 answer
129 views

Automatically open Jira ticket for issues in Snyk

I would like to be able to open tickets automatically from Snyk to Jira for new issues found. Based on new or existing vulnerabilities. And I would like to be able to create Jira tickets for issues ...
Jonathan Gruber's user avatar
1 vote
1 answer
32 views

Snyk SCA (Software Composition Analysis) and continuous monitoring

Does Snyk support doing SCA + continuous monitoring of the findings when configuring an SCM integration? How would it work and what are the different steps to configure to get regular scans as we ...
Wesley Bentura's user avatar
1 vote
1 answer
82 views

Snyk and Automatic Pull request

Does Snyk send PRs automatically when integrating from the SCM (Github, Gitlab...) ? I tried the Fix PR with Snyk and that worked - now I'd like to automate the PR
Wesley Bentura's user avatar
2 votes
1 answer
42 views

What is the breaking change criteria with Snyk

What is the criteria for choosing what upgrade involves a breaking change at Snyk when it comes to the Fix pull/merge request. For example, Pillow v8.1.2 to v9.2.0 I tried to upgrade the pillow ...
Wesley Bentura's user avatar
4 votes
1 answer
200 views

How can Snyk push notifications to MS Teams?

Snyk has native integrations to Slack, ServiceNow, Jira and others But no integration to MS Teams How can a team get Snyk notifications pushed to MS Teams?
Jonathan Gruber's user avatar
0 votes
1 answer
158 views

How to solve ReDOS pointed out by snyk

I'm new to frontend programming. I'm charged to check vulnerabilities on an app. I'm using Snyk which point out this portion of code as code security vulnerability: const re = new RegExp('(' + query....
Zik 3r's user avatar
  • 1
2 votes
1 answer
321 views

How do we ignore folders in Snyk

How can I ignore/exclude folders or directories when scanning a project at Snyk, whether in CLI or in SCM scan? It seems that an import of a Snyk Code or Snyk Open Source project don't behave in the ...
Jonathan Gruber's user avatar
0 votes
0 answers
52 views

NTIA minimum SBOM requirement tool

I am trying to generate SBOM for Java, Python, ios(Swift) and Android (kotlin) project. I need to follow the NTIA guidelines for minimum element for SBOM (https://www.ntia.doc.gov/files/ntia/...
bostonjava's user avatar
0 votes
2 answers
49 views

How to stay on top of OWASP dependencycheck reports

We are using OWASP dependency check. It's a great tool, but it reports lots of vulnerabilities. A big proportion of them is false positives. We can suppress them using the suppression file, but with ...
Lukas's user avatar
  • 13.6k
4 votes
1 answer
131 views

How can I plug Snyk vulnerability scans into JIRA so I get automatically created tickets when new vulns are discovered?

I'd like to configure my Snyk organization so that newly discovered vulnerabilities automatically generate a new ticket in Jira that I can assign to someone on my team to remediate. Any idea how I can ...
rdegges's user avatar
  • 32.9k
1 vote
1 answer
85 views

Snyk Suggests higher version of dependent starters than the spring boot version

We are using Snyk for vulnerability checks in our build pipelines. The spring boot version that is being used in the project is 2.6.6 and the versions of all other dependencies are hence inherited. ...
mukut bhattacharjee's user avatar
0 votes
0 answers
44 views

Issue running Snyk test against a fresh firebase project

I am trying to get started with Snyk on my existing Firebase project and running into this error when trying snyk test: Dependency firebase-admin was not found in package-lock.json. Your package.json ...
GeneRator's user avatar
0 votes
2 answers
55 views

Snyk disabling an automatic test

I'm totally surprised but I looks like it's not possible to disable Snyk automatic tests. In my case Snyk integrated with bitbucket. Snyk analyze code each time new commit is merged. I want to test ...
RedBluff's user avatar
5 votes
1 answer
276 views

Is it possible to solve org.jetbrains.kotlin:kotlin-stdlib vulnerability from OkHttp?

I'm using Snyk service to check my projects for vulnerabilities. Projects with OkHttp dependency have one common vulnerability: Vulnerable module: org.jetbrains.kotlin:kotlin-stdlib Introduced through:...
Yevhen Vasyliev's user avatar
1 vote
1 answer
454 views

Ignore snyk code quality issue with .snyk file

Snyk finds some code quality issue that should be ignored. I'm using Snyk CLI: "snyk code test" ✗ [High] Server-Side Request Forgery (SSRF) Path: project/src/main/java/com/MyClass.java, ...
Nickname0222022022's user avatar
0 votes
1 answer
172 views

Ignore all instances of certain software license

I have a .snyk file with a number of entries like these: 'snyk:lic:maven:org.clojure:tools.analyzer.jvm:EPL-1.0': - '*': reason: 'ignore license issue' expires: '2100-01-15T00:00:...
Brett Rowberry's user avatar
1 vote
2 answers
317 views

Snyk CLI for docker scan azure pipeline

I need to run snyk scan for Azure container and set it to fail only when there are new vulnerabilities found as compared to previous image. I did follow the snyk-delta document to configure task in ...
Vaybhaw's user avatar
  • 11
0 votes
0 answers
80 views

Using Snyk-Delta for Azure container image scan

I am trying to configure synk-delta to fail SNYK security scan task only if new vulnerabilities are being introduced in ACR. We need to run snyk scan for Azure container and set it to fail only when ...
Vaybhaw's user avatar
  • 11
0 votes
1 answer
201 views

How can I add a snyk badge to my private repository?

I want to add badges to a the readme file showing the green or red badges for the vulnerabilities detected by snyk. I am using snyk and have integrated it with my GitHub account. Accroding to the snyk ...
Jayanta Basumatary's user avatar
0 votes
1 answer
62 views

Snyk server can be installed in a machine without internet?

I have been using sonarqube and now i want to use snyk but dont know if it is possible to install it in an machine locally and without internet access. Snyk server can be install in an local machine ...
Wonser's user avatar
  • 1
1 vote
1 answer
629 views

Snyk vulnerability scan not recognizing overriden nested package dependencies

I am running the snyk test command on my project to identify vulnerabilities with third party libraries and came across the following vulnerabilities in react-scripts@5.0.1 ->@svgr/webpack": &...
svs's user avatar
  • 23
0 votes
1 answer
169 views

Snyk finds vulnaribilities in Simple Injector

In our .NET 6 apis we are using Simple Injector for dependency injection. With the latest version of Simple Injector, we observed that Snyk found five high-priority vulnerabilities and two medium ...
Thomas Limburg's user avatar
0 votes
0 answers
59 views

Information regarding XSS vulnerabilities reported by Snyk

In a need to introduce Test Management to help our QA engineering team , we are looking for some tools and have come across Kiwi TCMS . We are considering of onboarding the software to help our QA ...
JoshuaAtEriks's user avatar
0 votes
1 answer
61 views

Docker scan step is failing on pipeline with login error

I am trying to use docker scan command in gitlab CI. I am loggin in to docker hub using docker login command and after that I am running docker scan --accept-license :. On my local machine everything ...
Hovo Grigoryan's user avatar
19 votes
4 answers
34k views

upgrade to SnakeYaml 1.31 in spring-boot-starter-parent 2.7.3

Have springboot project in which wanted to either exclude snakeyaml 1.30 or upgrade it 1.31 inorder to avoid fortify issue reporting with snakeyaml 1.30 version there is security vulnerability <...
Syed Rafi's user avatar
  • 835
0 votes
1 answer
393 views

I have Integrated Snyk Security Tool with Jenkins I am getting below Issue(I am Using DOTNET Core 3.0 Version project)

FATAL: Snyk Security scan failed. java.lang.RuntimeException: An error occurred. Could not detect supported target files in C:\ProgramData\Jenkins\.jenkins\workspace\ZAPTest. Please see our ...
MosesAlfred's user avatar
1 vote
1 answer
93 views

Performing multiplication on a string (from calling toFixed) and a number error

I get an error on typescript using Snyk Code Quality: Performing multiplication on a string (from calling toFixed) and a number (from number literal 10) will trigger an implicit coercion of the ...
ebanster's user avatar
  • 886
0 votes
2 answers
385 views

Unable to resolve issues in devops CI-CD pipeline snyk scans

I have pushed a react solution into devops repository and created one pipeline for build and scans. We are using snyk scan to scan the solution; here is the yaml code of snykscan: scanSnyk: true ...
Alien 'D' mars's user avatar
0 votes
1 answer
137 views

Can my application be vulnerable because of an oudated Docker image?

Currently, my company wants to ensure that everything is secure, and now I'm doing some tests to verify that our Docker containers achieve this. My first concern comes in after I realized that after ...
Paul S-Pou's user avatar
2 votes
1 answer
806 views

How to ignore a vulnerability for a specific file

The following Snyk vulnerability is being reported when I run % snyk code test Testing /mydir ... ✗ [High] Cross-Site Request Forgery (CSRF) Path: src/com/xxx/ConfigSecurity.java, line 22 ...
SERGIO STATERI JUNIOR's user avatar
1 vote
1 answer
2k views

Could not detect supported target files in 'project directory'see documentation supported languages target, make sure you are in the right directory

I am new to Snyk and I have installed synk-cli and ran the command snyk monitor on the root directory of my project which contains two apps, client == reactJS, server== python(Django), I have ...
Yusuf's user avatar
  • 2,325
1 vote
1 answer
303 views

integrating snyk with my azure pipeline security concerns

I am integrating Snyk with my Azure pipeline, but my concerns are: 1- is Snyk take a copy of my source code and save it on their servers, as I am connecting and giving authentication with an API key ...
M K's user avatar
  • 13
0 votes
3 answers
192 views

Snyk Code Upload Results To Dashboard like Monitor

I'm trying to run Snyk on bitbucket pipeline. I'm running the pipes for composer and npm and things are working but I also want to run it for static code analysis. None of the documentation shows how ...
Chris Quibell's user avatar
0 votes
0 answers
39 views

Bash running cli command over and over when exit code is 1 [duplicate]

I am working on a pre-commit hook bash script that makes use of a cli tool (snyk). Here is an example: #!/usr/bin/env bash echo "running snyk code test" snyk code test If I invoke the above ...
super-fun's user avatar
1 vote
1 answer
1k views

Snyk monitor command is failing

I am running below SNYK command for standard WAS application. snyk monitor --all-projects It is failing because there is a war-src module which contains ${project.version} tag and this version is ...
Vinutha's user avatar
  • 17
0 votes
1 answer
61 views

Snyk For talend package

we are trying to scan talend package, is there any documentation for scanning talend packages through snyk? thanks Sundar
Sundar's user avatar
  • 95
2 votes
1 answer
1k views

How to do Snyk code test in Jenkins pipeline?

I am helping our DevOps team integrate Snyk into the Jenkins pipelines for SAST. By default, it seems like this Snyk plugin is doing snyk test (which does open-source dependency scans) and appends the ...
iamahecker's user avatar
0 votes
1 answer
440 views

Install Snyk in Jenkins "Global Tool Configuration" using groovy

I'm trying to add a Snyk installation to Jenkins using groovy. The plugin is installed and I can see the installation option in Global Tool Configuration: The problem is the Descriptor is not ...
João Amaro's user avatar
0 votes
1 answer
71 views

bug or genuine issue with identifying dependencies

I am quite confused by this message from Snyk. It seems I have all dependencies I need. + pip3 install -r requirements.txt Requirement already satisfied: numpy==1.21.5 in ./venv/lib/python3.9/site-...
ha9u63a7's user avatar
  • 6,271