Type confusion

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

CVE-2020-1911

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

@elliemae/pui-cli (>=0.0.1, <=0.0.2-beta.4), react-native-github-markdown (>=2.1.0, <=2.2.0) potentially affected by CVE-2019-16728 via dompurify (>=2.0.0, <=2.0.2)

dompurify NPM version =2.0.0, =0.0.1, =2.1.0, =2.2.0 Source cves: CVE-2019-16728 Source advisory: OSV:GHSA-CHQJ-J4FH-RW7M...

@elliemae/pui-cli (>=0.0.1, <=0.0.2-beta.4), react-native-github-markdown (>=2.1.0, <=2.2.0) potentially affected by CVE-2019-16728 via dompurify (>=2.0.0, <=2.0.2)

dompurify NPM version =2.0.0, =0.0.1, =2.1.0, =2.2.0 Source cves: CVE-2019-16728 Source advisory: GHSA-CHQJ-J4FH-RW7M...

react-native-fast-image information disclosure vulnerability

react-native-fast-image is an image loading and processing package by Canadian software developer Dylan Vann. An information disclosure vulnerability exists in react-native-fast-image, which can be exploited by an attacker to cause signature credentials or other session tokens to be disclosed to...

@ada-support/react-native-sdk (>=0.0.1, <=0.0.8), @adadapted/react-native-sdk (>=1.0.0, <=2.0.0) +319 more potentially affected by CVE-2020-6506 via react-native-webview (>=2.8.0, <=10.10.2)

react-native-webview NPM version =2.8.0, =0.0.1, =1.0.0, =0.1.0, =5.2.0, =11.0.0-alpha.0, =1.0.0, =0.13.0, =1.0.0, =4.6.201906191752-test, =2.37.1, =0.2.3, =0.2.23 and more Source cves: CVE-2020-6506 Source advisory: MEND:CVE-2020-6506...

CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

Authorization

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

CVE-2020-7696 Information Exposure

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

CVE-2020-7696

The CVE-2020-7696 entry affects all versions of react-native-fast-image. When an image is loaded with headers that include sensitive data (e.g., host and authorization in the request headers), subsequent images reuse those headers, causing potential leakage of signing credentials or session token...

CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

@agungkes/react-native-scalable-image (>=1.0.1, <=1.0.2), @applicaster/zapp-react-native-fast-image (>=1.0.0, <=1.1.0-beta.0) +34 more potentially affected by CVE-2020-7696 via react-native-fast-image (>=4.0.14, <=8.2.0)

react-native-fast-image NPM version =4.0.14, =1.0.1, =1.0.0, =1.8.20, =1.0.21, =0.0.8, =0.0.8, =0.0.1, =0.0.1, =0.10.25, =1.0.113, =1.0.0, =1.0.3 and more Source cves: CVE-2020-7696 Source advisory: MEND:CVE-2020-7696...

CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

CVE-2020-7696: Exposure of Sensitive Information to an Unauthorized Actor

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

PT-2020-19719

Name of the Vulnerable Software and Affected Versions react-native-fast-image versions prior to 8.3.0 Description The issue arises when an image is loaded with a source that includes headers, such as host and authorization. This causes all subsequent images to use the same headers, potentially...

@applicaster/zapp-react-native-fast-image (>=1.0.0, <=1.1.0-beta.0), @momo-platform/component-kits (1.1.74) +5 more potentially affected by CVE-2020-7696 via react-native-fast-image (>=8.1.2, <=8.2.0)

react-native-fast-image NPM version =8.1.2, =1.0.0, =0.0.1, =0.1.0, =1.2.23 Source cves: CVE-2020-7696 Source advisory: SNYK:JS-REACTNATIVEFASTIMAGE-572228...

Information Exposure

Overview react-native-fast-image is a FastImage, performant React Native image component. Affected versions of this package are vulnerable to Information Exposure. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will...

CVE-2020-12270

React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it...

Design/Logic Flaw

React Native Bluetooth Scan in Bluezone 1.0.0 uses six-character alphanumeric IDs, which might make it easier for remote attackers to interfere with COVID-19 contact tracing by using many IDs. NOTE: the vendor disputes the relevance of this report because the recipient of an F1 alert will know it...