# CVE-2018-8292 alert in Github but not from SonarQube Scan **URL:** \ **Category:** SonarQube Server / Community Build\ **Tags:** github, security, dotnet\ **Created:** [January 14, 2022, 3:27pm UTC](https://community.sonarsource.com/t/cve-2018-8292-alert-in-github-but-not-from-sonarqube-scan/56406 "2022-01-14T15:27:35Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Prasen](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/prasen/32/29187_2.png) [@Prasen](https://community.sonarsource.com/u/Prasen)\ **Post date:** [January 14, 2022, 3:27pm UTC](https://community.sonarsource.com/t/cve-2018-8292-alert-in-github-but-not-from-sonarqube-scan/56406/1 "2022-01-14T15:27:35Z")
Hi , We have application source code in Github and CI pipeline integrated with SonarQube running via Azure Pipeline. Now with Github native security feature we are seeing alert ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/2/e/2e99c708d35706911b79373f980e80fec7faa88b.png) ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/c/d/cd9e2401afedc3c87aa4b59e407ae9ec0b45e3c7.png) However the same through Sonar Scanner is not coming as Security hotspot or vulnerability. Could you please explain why there is a mismatch I am experiencing. ---
**Author:** ![Hendrik\_Buchwald](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/hendrik_buchwald/32/69290_2.png) [@Hendrik\_Buchwald](https://community.sonarsource.com/u/Hendrik_Buchwald)\ **Post date:** [January 17, 2022, 8:43am UTC](https://community.sonarsource.com/t/cve-2018-8292-alert-in-github-but-not-from-sonarqube-scan/56406/2 "2022-01-17T08:43:29Z")
Hi Prasenjit and welcome to the community! GitHub is warning you about a vulnerability in a dependency, so-called Software Composition Analysis (SCA). At this time we are focussing on Static Application Security Testing (SAST) though and do not provide SCA. ---
**Author:** ![anon67236913](https://avatars.discourse-cdn.com/v4/letter/a/c37758/32.png) [@anon67236913](https://community.sonarsource.com/u/anon67236913)\ **Post date:** [January 17, 2022, 9:51am UTC](https://community.sonarsource.com/t/cve-2018-8292-alert-in-github-but-not-from-sonarqube-scan/56406/3 "2022-01-17T09:51:00Z")
Welcome 🙂 if using Sonarqube on prem, you may try the community plugin (not supported by Sonarsource) > **[GitHub - dependency-check/dependency-check-sonar-plugin: Integrates...](https://github.com/dependency-check/dependency-check-sonar-plugin)** > > Integrates Dependency-Check reports into SonarQube - GitHub - dependency-check/dependency-check-sonar-plugin: Integrates Dependency-Check reports into SonarQube Gilbert ---
**Author:** ![Prasen](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/prasen/32/29187_2.png) [@Prasen](https://community.sonarsource.com/u/Prasen)\ **Post date:** [January 17, 2022, 10:30am UTC](https://community.sonarsource.com/t/cve-2018-8292-alert-in-github-but-not-from-sonarqube-scan/56406/4 "2022-01-17T10:30:04Z")
> [@Hendrik\_Buchwald](#): > > s warning you about a vulnerability in Hi Hendrik , That makes sense now to me . Thanks for the help. ---
**Author:** ![Prasen](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/prasen/32/29187_2.png) [@Prasen](https://community.sonarsource.com/u/Prasen)\ **Post date:** [January 17, 2022, 10:31am UTC](https://community.sonarsource.com/t/cve-2018-8292-alert-in-github-but-not-from-sonarqube-scan/56406/5 "2022-01-17T10:31:32Z")
Hey Gilbert , Yes , we have SonarQube on prem . I will check that . Thanks . ---
**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\ **Post date:** [January 24, 2022, 10:31am UTC](https://community.sonarsource.com/t/cve-2018-8292-alert-in-github-but-not-from-sonarqube-scan/56406/6 "2022-01-24T10:31:35Z")
Closed on January 24, 2022, 10:31am UTC This topic was automatically closed 7 days after the last reply. New replies are no longer allowed. ---
**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\ **Post date:** [March 18, 2025, 2:28pm UTC](https://community.sonarsource.com/t/cve-2018-8292-alert-in-github-but-not-from-sonarqube-scan/56406/7 "2025-03-18T14:28:29Z")
Hello from the future! We recently announced SonarQube Advanced Security, which will include SCA capabilities. While it’s not available yet, we expect general availability for SonarQube Server in May 2025, and SonarQube Cloud Enterprise shortly after. Please see this announcement for more details. > [@Announcing SonarQube Advanced Security](https://community.sonarsource.com/t/announcing-sonarqube-advanced-security/136625): > > Sonar is excited to [announce SonarQube Advanced Security](https://www.sonarsource.com/company/press-releases/sonar-extends-code-security-coverage-with-sonarqube-advanced-security/), extending SonarQube’s analysis capabilities beyond first-party and AI-generated code to include third-party open source code. With this, we’re delivering the first fully integrated solution for finding and fixing code quality and code security issues in the development phase of the SDLC. The first step in integrating Sonar’s recent acquisition of Tidelift, SonarQube Advanced Security strengthens a robust set of existing security capabili…