Out-of-bounds Read and Out-of-bounds Write in Facebook Hermes

An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the...

GHSA-F5X2-XV93-4P23 Access of Resource Using Incompatible Type in Facebook Hermes

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

Access of Resource Using Incompatible Type in Facebook Hermes

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only...

CVE-2020-1914

A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable i...

CVE-2022-29230

Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting XSS vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from...

Cross site scripting

Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting XSS vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from...

CVE-2022-29230 Potential cross-site scripting (XSS) vulnerability in Hydrogen

Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting XSS vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from...

CVE-2022-29230

Hydrogen (Shopify) has a reported Cross-Site Scripting (XSS) vulnerability affecting version range 0.10.0 to 0.18.0, exploitable when hydrating data is user-controlled. The issue may allow an arbitrary script to run in pages built with Hydrogen. A fix is available: upgrade to v0.19.0; CSP is not ...

Malicious code in pp-react-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 000ff8cda66b7a099f0780508fa3aa26f9c586ea54c2ec040c448b46ba5e8a97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5434 Malicious code in pp-react-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 000ff8cda66b7a099f0780508fa3aa26f9c586ea54c2ec040c448b46ba5e8a97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-29230: Improper Neutralization of Input During Web Page Generation

Hydrogen is a React-based framework for building dynamic, Shopify-powered custom storefronts. There is a potential Cross-Site Scripting XSS vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from...

Hydrogen 跨站脚本漏洞

Hydrogen is a React-based framework for Shopify individual developers. It is used to build dynamic, custom storefronts powered by Shopify. A cross-site scripting vulnerability exists in Hydrogen versions 0.10.0 through 0.18.0, which can be exploited by an attacker to execute script on pages built...

PayloadCMS arbitrary file upload vulnerability

PayloadCMS is a Headless CMS and application framework built using TypeScript, Node.js, React and MongoDB.PayloadCMS is vulnerable to arbitrary file uploads, which can be exploited by attackers to execute arbitrary code via crafted SVG files...

JHipster SQL Injection Vulnerability

JHipster is an open source application builder that develops web applications and microservices primarily using Angular or React and Spring Framework.JHipster suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements, whic...

10-24-dars (1.0.0), @alephdata/react-ftm (>=1.9.1, <=2.4.0-alpha.2) +206 more potentially affected by CVE-2021-23632 via git (0.1.5)

git NPM version 0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on git and may be impacted: - 10-24-dars 1.0.0 - @alephdata/react-ftm =1.9.1, =1.5.2, =0.4.120, =1.0.0-alpha.0, =7.7.1, =1.1.7, =1.0.1, =0.13.1, =1.12.2, =1.0.0, =2.1.1 and more Source...

CVE-2022-24740

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and...

GHSA-CFHH-XGWQ-5R67 Sudden swap of user auth tokens in Volto

Impact Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that a user could get his/her auth cookie replaced with the auth cookie from another user, effectively giving him full access to the other users account...

Sudden swap of user auth tokens in Volto

Impact Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that a user could get his/her auth cookie replaced with the auth cookie from another user, effectively giving him full access to the other users account...

CVE-2022-24740

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and...

Spoofing Attack

swagger-ui-react is vulnerable to spoofing attack. The vulnerability allows remote attackers to acquire remote OpenAPI definitions by persuading the victim to open a specifically crafted URL...