CVE-2017-16028

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG Math.random...

CVE-2016-10697

react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources...

CVE-2016-10697: Missing Encryption of Sensitive Data

react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources...

CVE-2017-16028: Use of Insufficiently Random Values

react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG Math.random...

PT-2018-4875

Name of the Vulnerable Software and Affected Versions react-native-baidu-voice-synthesizer affected versions not specified Description The issue concerns the react-native-baidu-voice-synthesizer downloading resources over HTTP, making it susceptible to Man-in-the-Middle MITM attacks. This could...

PT-2018-6058

Name of the Vulnerable Software and Affected Versions: react-native-meteor-oauth affected versions not specified randomatic versions prior to 3.0.0 Description: The issue concerns the generation of random values using a non-cryptographically strong pseudo-random number generator, which may result...

Cryptographically Insecure Token Generation

react-native-meteor-oauth generates insecure tokens. These tokens are insecure because they are generated using the randomatic package which is not cryptographically secure. This makes it easier for attackers to brute force tokens...

Cross-site Scripting (XSS) Via SendToBridge

react-native-webview-bridge is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of user input sanitization when a user can send a string through sendToBridge. The unsanitized string is then interpreted as JavaScript code, causing the webview to be affected ...