5003 matches found
CVE-2024-40631 Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media
Plate media is an open source, rich-text editor for React. Editors that use MediaEmbedElement and pass custom urlParsers to the useMediaState hook may be vulnerable to XSS if a custom parser allows javascript:, data: or vbscript: URLs to be embedded. Editors that do not use urlParsers and consume...
CVE-2024-40631
The CVE-2024-40631 vulnerability affects Plate’s media embedding in editors using MediaEmbedElement with custom urlParsers in @udecode/plate-media. Affected code paths allow un-sanitised URLs (javascript:, data:, vbscript:) to reach iframe sources via the embed property from useMediaState, or the...
CVE-2024-39903
Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion LFI vulnerability was identified in widgetti/solara, in version 1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI...
CVE-2024-39903 Local File Inclusion in Solara
Solara is a pure Python, React-style framework for scaling Jupyter and web apps. A Local File Inclusion LFI vulnerability was identified in widgetti/solara, in version 1.35.1, which was fixed in version 1.35.1. This vulnerability arises from the application's failure to properly validate URI...
Malicious code in react-native-latest (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1015ecd9733ee94027b1c081070e5866c9bdeb055d78f16a4664531fadba690d The OpenSSF Package Analysis project identified 'react-native-latest' @ 200.0.1 npm as malicious. It is considered malicious because: - The...
MAL-2024-7730 Malicious code in react-native-latest (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1015ecd9733ee94027b1c081070e5866c9bdeb055d78f16a4664531fadba690d The OpenSSF Package Analysis project identified 'react-native-latest' @ 200.0.1 npm as malicious. It is considered malicious because: - The...
Solara Security Breach
Solara is a pure Python, React style framework open sourced by widgetti. It is used to extend Jupyter and web applications. A security vulnerability exists in Solara versions prior to 1.35.1, which stems from a failure to properly validate a URI fragment for a directory traversal sequence, which...
CVE-2024-39693
CVE-2024-39693 is a DoS in Next.js (React framework) that can crash the server, affecting availability. The issue affects Next.js versions prior to 13.5 and is resolved in 13.5 and later. Connected sources consistently describe a DoS condition without detailing exploit vectors or specific vulnera...
MAL-2024-7418 Malicious code in react-devtools-fusebox (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 023ce7599294ef47cf0b24d7424bada9cfa75c0c3ac1f94d0a2a23e0e4f55d6b The OpenSSF Package Analysis project identified 'react-devtools-fusebox' @ 2.1.1 npm as malicious. It is considered malicious because: - The...
Malicious code in react-devtools-fusebox (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 023ce7599294ef47cf0b24d7424bada9cfa75c0c3ac1f94d0a2a23e0e4f55d6b The OpenSSF Package Analysis project identified 'react-devtools-fusebox' @ 2.1.1 npm as malicious. It is considered malicious because: - The...
Malicious code in react-release-script (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef588daeba2a0ed635c0f3dce7387b25c88ecca3e924b5d01048b11e1e6def2a The OpenSSF Package Analysis project identified 'react-release-script' @ 1.9.9 npm as malicious. It is considered malicious because: - The packa...
MAL-2024-7098 Malicious code in react-release-script (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef588daeba2a0ed635c0f3dce7387b25c88ecca3e924b5d01048b11e1e6def2a The OpenSSF Package Analysis project identified 'react-release-script' @ 1.9.9 npm as malicious. It is considered malicious because: - The packa...
@nokecy/qc-ui (>=0.4.7 <=0.9.6), ag-grid-charts-enterprise (=32.0.0) +3 more potentially affected by CVE-2024-39001 via ag-grid-community (=32.0.0)
ag-grid-community NPM version =32.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ag-grid-community and may be impacted: - @nokecy/qc-ui =0.4.7, =0.9.6 - ag-grid-charts-enterprise =32.0.0 - ag-grid-enterprise =32.0.0 - ag-grid-react =32.0.0 -...
MAL-2024-7048 Malicious code in @yu-life/react-native-yu-watch (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 461986fa4cbfe6bda33bdb99901a4c0f05e00934b4a3c5b529f1236dba9d4b1b The OpenSSF Package Analysis project identified '@yu-life/react-native-yu-watch' @ 1.0.1 npm as malicious. It is considered malicious because: -...
Malicious code in wf-dbd-react-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0298d6396635472198baea5a751b125cd374bce845178bac3e4738ec1c2c73ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-3949 Malicious code in wf-dbd-react-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0298d6396635472198baea5a751b125cd374bce845178bac3e4738ec1c2c73ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in tools-access-react-redux-router (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-3139 Malicious code in tools-access-react-redux-router (npm)
--- -= Per source details. Do not edit below this line.=-...