EUVD-2018-0484

Malware in sbrugna...

Missing Origin Validation in parcel-bundler

Withdrawn: Duplicate of GHSA-37q6-576q-vgr7...

GHSA-5J4M-89XF-MF5P Missing Origin Validation in parcel-bundler

Withdrawn: Duplicate of GHSA-37q6-576q-vgr7...

@achil/parcel-bundler (>=1.11.1, <=1.12.34), @acies/core (>=1.2.89, <=1.2.215) +132 more potentially affected by CVE-2019-10769 via safer-eval (>=1.2.3, <=1.3.6)

safer-eval NPM version =1.2.3, =1.11.1, =1.2.89, =0.1.0, =4.0.0, =4.1.0, =4.1.2, =0.9.2-pre.41, =2.0.2-pre.3, =1.0.0, =1.9.3-ext.1, =0.3.0, =1.12.3, =1.0.0, =0.0.1, =3.4.4 and more Source cves: CVE-2019-10769 Source advisory: OSV:GHSA-V63X-XC9J-HHVQ...

Missing Origin Validation

Overview Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not...

@dailybruin/lux (>=1.0.0, <=1.0.4), @dsbn/slate (0.0.1) +18 more potentially affected by CVE-2018-14731 via parcel-bundler (>=1.2.0, <=1.9.7)

parcel-bundler NPM version =1.2.0, =1.0.0, =1.1.0, =0.2.5, =1.0.0-alpha.2, =1.0.0-alpha.2, =0.0.12, =1.2.1, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2018-14731 Source advisory: OSV:GHSA-37Q6-576Q-VGR7...

Missing Origin Validation in parcel-bundler

Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...

GHSA-37Q6-576Q-VGR7 Missing Origin Validation in parcel-bundler

Versions of parcel-bundler before 1.10.0 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...

Information Disclosure

parcel-bundler is vulnerable to information disclosure. The library does not validate the origin of the requests, allowing a malicious user to send a HMR Hot Module Replacement request to the application to gain access to the source code...

CVE-2018-14731

An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a...

Code injection

An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a...

CVE-2018-14731

An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a...

CVE-2018-14731

An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a...

CVE-2018-14731

The provided connected advisory for parcel-bundler identifies a concrete defect: versions before 1.10.0 of parcel-bundler’s WebSocket server lack origin validation for HMR, allowing a remote attacker to steal a developer’s source code via ws:// connections. This is caused by missing validation of...

CVE-2018-14731: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in HMRServer.js in Parcel parcel-bundler. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket server via a...

PT-2018-12688

Name of the Vulnerable Software and Affected Versions parcel-bundler versions prior to 1.10.0 Description An issue in HMRServer.js allows attackers to steal a developer's code due to the lack of origin validation on the WebSocket server used for Hot Module Replacement HMR. This enables anyone to...