GHSA-68C2-4MPX-QH95 Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin

Impact SDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes. Doing so would result in the auth token being built into the application bundle, and therefore the auth token could be...

@bundly/ic-core-js (>=0.1.0, <=0.4.2-rc.4), @bundly/ic-react (>=0.1.0, <=0.4.2-rc.4) +8 more potentially affected by CVE-2024-1631 via @dfinity/auth-client (>=0.20.2, <=0.21.4)

@dfinity/auth-client NPM version =0.20.2, =0.1.0, =0.1.0, =0.1.1, =0.0.1, =0.0.1, =0.0.3, =0.0.2, =0.0.38-next-2023-12-19, =0.0.1, =0.0.7 Source cves: CVE-2024-1631 Source advisory: OSV:GHSA-C9VV-FHGV-CJC3...

@apolitical/component-library (>=1.7.0-beta.1, <=10.5.3), @apolitical/styleguide2 (>=3.17.0-rc.1, <=7.8.1) +60 more potentially affected by CVE-2024-21535 via markdown-to-jsx (>=7.0.0, <=7.3.2)

markdown-to-jsx NPM version =7.0.0, =1.7.0-beta.1, =3.17.0-rc.1, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =6.1.1, =7.3.2, =0.1.0, =0.9.1, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =0.1.0-alpha.39, =1.1.1-beta.3, =1.2.2 and more Source cves: CVE-2024-21535 Source advisory:...

@kafudev/react-native-shell (>=0.66.4-beta.18, <=0.66.5-beta.8), @likeminds.community/chat-rn-core (>=0.5.0, <=1.0.1) +4 more potentially affected by CVE-2024-25466 via react-native-document-picker (>=8.0.0, <=8.2.0)

react-native-document-picker NPM version =8.0.0, =0.66.4-beta.18, =0.5.0, =0.0.8, =0.0.1, =0.5.0, =0.5.14 - yan-react-hook-form 0.1.7 Source cves: CVE-2024-25466 Source advisory: OSV:GHSA-PMGM-H3CC-M4HJ...

@icanbwell/composite (>=1.89.4, <=1.202.0), @icanbwell/native-components (>=0.21.6, <=0.31.0) +4 more potentially affected by CVE-2024-25466 via react-native-document-picker (>=9.0.1, <=9.1.0)

react-native-document-picker NPM version =9.0.1, =1.89.4, =0.21.6, =0.14.5, =1.1.0, =1.8.0 - @likeminds.community/feed-rn-core 0.6.0 - @likeminds.community/feed-rn-core-beta 0.0.1 Source cves: CVE-2024-25466 Source advisory: OSV:GHSA-PMGM-H3CC-M4HJ...

React Native Document Picker Directory Traversal vulnerability

Directory Traversal vulnerability in React Native Document Picker before 8.2.2 and 9.x before 9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

GHSA-PMGM-H3CC-M4HJ React Native Document Picker Directory Traversal vulnerability

Directory Traversal vulnerability in React Native Document Picker before 8.2.2 and 9.x before 9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

CVE-2024-25466

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

Directory traversal

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

React Native Security Vulnerabilities

React Native is an open source JavaScript framework. It is used to build user interfaces and native applications. A security vulnerability exists in React Native Document Picker versions prior to v.9.1.1, which stems from a path traversal vulnerability in the component Android library...

CVE-2024-25466

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

CVE-2024-25466

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

CVE-2024-25466

CVE-2024-25466 is a directory traversal vulnerability in React Native Document Picker affecting versions prior to 9.1.1 . The root cause is an Android library component that processes crafted scripts, allowing a local attacker to execute arbitrary code. The vulnerability is fixed in version 9.1.1...

CVE-2024-25466

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

CVE-2024-25466: Path Traversal: '/dir/../filename'

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

PT-2024-20960

Name of the Vulnerable Software and Affected Versions React Native Document Picker versions prior to 9.1.1 React Native Document Picker version 8.2.2 and earlier Description A Directory Traversal issue allows a local attacker to execute arbitrary code via a crafted script to the Android library...

CVE-2024-25466

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

Malicious code in @ebay/ui-core-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 910fed2596a854101b97448fdf2993d6012a25a091cf60e0f3c47540f295af3e @ebay/[email protected] is a scoped React UI component library published under the eBay organization scope. No indicators of credential exfiltratio...

MAL-2024-1006 Malicious code in @ebay/ui-core-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 910fed2596a854101b97448fdf2993d6012a25a091cf60e0f3c47540f295af3e @ebay/[email protected] is a scoped React UI component library published under the eBay organization scope. No indicators of credential exfiltratio...

CVE-2024-24558

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...