CVE-2019-10773

The CVE-2019-10773 issue affects Yarn prior to 1.21.1, where the package install functionality can be abused via specially crafted bin keys to generate arbitrary symlinks on the host filesystem. This can lead to existing files being overwritten depending on user permissions. The vulnerability ste...

CVE-2019-10773

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set...

Unauthorized File Access

yarn is vulnerable to unauthorized file overwrite. The vulnerability exists as it was possible to create symlinks to files, using the value of bin, to access files out of the nodemodules folder...

@6river/rosbag (>=1.0.2-6river, <=1.1.0-browserOrNode.2), @jamesbliss/react-flickity (>=1.0.0, <=1.4.0) +30 more potentially affected by CVE-2019-10773 via yarn (>=1.0.2, <=1.21.0)

yarn NPM version =1.0.2, =1.0.2-6river, =1.0.0, =1.9.9-1, =1.0.0, =1.0.21, =8.3.8, =0.1.0, =3.0.0, =0.0.1, =0.0.0-semantic-release, =1.9.7, =5.0.0-ts.4, =5.0.13 and more Source cves: CVE-2019-10773 Source advisory: SNYK:JS-YARN-537806...

PT-2019-1106 · Npm +6 · Npm +6

Name of the Vulnerable Software and Affected Versions: npm CLI versions prior to 6.13.3 Description: The issue is related to errors in link handling in the npm and Yarn package managers. Exploitation of this issue may allow a remote attacker to write arbitrary files by creating a symbolic link to...

Node.js third-party modules: Filesystem Writes via `yarn install` via symlinks and tar transforms inside a crafted malicious package

I would like to report an arbitrary filesystem write vulnerability in Yarn when installing a malicious package from the default repositories. This vulnerability has the potential for RCE -- even if --ignore-scripts is disabled. It allows a malicious package, upon install, to write to any path on...

Photon OS 3.0: Yarn PHSA-2019-3.0-0034

An update of the yarn package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-3.0-0034. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid130123;...

Critical Photon OS Security Update - PHSA-2019-0034

Updates of 'rsyslog', 'linux-esx', 'libpcap', 'tcpdump', 'yarn', 'linux', 'linux-secure', 'linux-aws' packages of Photon OS have been released...

Critical Photon OS Security Update - PHSA-2019-3.0-0034

Updates of 'tcpdump', 'linux-aws', 'yarn', 'linux', 'libpcap', 'linux-secure', 'linux-esx', 'rsyslog' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2019-0181

Updates of 'yarn' packages of Photon OS have been released...

Photon OS 1.0: Yarn PHSA-2019-1.0-0252

An update of the yarn package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0252. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid129789;...

Photon OS 1.0: Yarn PHSA-2019-1.0-0255

An update of the yarn package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0255. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid129687;...

Important Photon OS Security Update - PHSA-2019-0252

Updates of 'linux', 'tar', 'bash', 'yarn', 'linux-esx', 'python2', 'openssl', 'kubernetes' packages of Photon OS have been released...

Node.js third-party modules: [yarn] yarn.lock integrity & hash check logic is broken

I would like to report a vulnerability in yarn. It allows to pollute yarn cache via a crafted yarn.lock file and place a malicious package into cache under any name/version, bypassing both integrity and hash checks in yarn.lock so that any future installs of that package will install the fake...

Photon OS 2.0: Yarn PHSA-2019-2.0-0176

An update of the yarn package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0176. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid129296;...

@6river/rosbag (>=1.0.2-6river, <=1.1.0-browserOrNode.2), @jamesbliss/react-flickity (>=1.0.0, <=1.4.0) +26 more potentially affected by CVE-2019-5448 via yarn (>=1.0.2, <=1.16.0)

yarn NPM version =1.0.2, =1.0.2-6river, =1.0.0, =1.9.9-1, =1.0.0, =1.0.21, =8.3.8, =0.1.0, =3.0.0, =0.0.0-semantic-release, =1.9.7, =5.0.0-ts.4, =0.0.4, =0.0.14 and more Source cves: CVE-2019-5448 Source advisory: OSV:GHSA-WQFC-CR59-H64P...

GHSA-WQFC-CR59-H64P Missing Encryption of Sensitive Data in yarn

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

Missing Encryption of Sensitive Data in yarn

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

Information Disclosure

yarn is vulnerable to information disclosure. The attack is possible because it does not use a secure connection for regular registries, allowing a man-in-the-middle to disclose and manipulate the sensitive information...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...