brocode (>=1.0.0, <=2.0.0-pre4), browserify-lazy-server (>=0.0.0-beta.0, <=0.0.0-beta.1) +10 more potentially affected by CVE-2018-14730 via browserify-hmr (0.3.7)

browserify-hmr NPM version 0.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on browserify-hmr and may be impacted: - brocode =1.0.0, =0.0.0-beta.0, =0.2.0, =3.5.0, =1.0.0, =0.0.3, =2.3.0, =0.1.0, =1.0.0, =0.1.0, =0.0.11, =0.0.13 Source cves:...

CVE-2018-14730

The CVE-2018-14730 entry concerns Browserify-HMR. Affected component: the WebSocket server used for Hot Module Replacement. Root cause: origin validation is missing, allowing any origin to receive HMR messages via ws://127.0.0.1:3123/ (or similar), enabling an attacker to access a developer’s cod...