GHSA-5645-GC7H-98H8 Malicious Package in react-dates-sc

Version 0.3.0 of react-dates-sc contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.3.0 of this module is found installed you...

Malicious Package in react-dates-sc

Version 0.3.0 of react-dates-sc contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.3.0 of this module is found installed you...

Malicious Package in awesome_react_utility

Version 1.0.2 of awesomereactutility contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.2 of this module is found installed...

react-cms-editor (0.1.71) potentially affected by CVE-2017-16080 via nodesass (0.0.2-security)

nodesass NPM version 0.0.2-security is affected by a known vulnerability. The following packages have a transitive dependency on nodesass and may be impacted: - react-cms-editor 0.1.71 Source cves: CVE-2017-16080 Source advisory: OSV:GHSA-XFMW-2VMM-579C...

PT-2020-21051

Name of the Vulnerable Software and Affected Versions react-dates-sc version 0.3.0 Description The issue concerns malicious code in version 0.3.0 of the react-dates-sc module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber from forms and...

PT-2020-21395

Name of the Vulnerable Software and Affected Versions react-marked-markdown versions affected versions not specified Description The issue concerns cross-site scripting XSS via href attributes in react-marked-markdown. This can be exploited when a user is provided to react-marked-markdown. There ...

PT-2020-21384

Name of the Vulnerable Software and Affected Versions awesome react utility version 1.0.2 Description The issue concerns malicious code in version 1.0.2 of the awesome react utility module. When executed in a browser, this code enumerates sensitive fields such as password, cvc, and cardnumber fro...

PT-2020-21287

Name of the Vulnerable Software and Affected Versions react-server-native version 0.0.7 Description The issue concerns malicious code in version 0.0.7 of react-server-native that, when executed in a browser, can extract sensitive information such as password, cvc, and cardnumber fields from forms...

@elliemae/pui-cli (>=0.0.1, <=0.0.2-beta.4), react-native-github-markdown (>=2.1.0, <=2.2.0) potentially affected by CVE-2019-16728 via dompurify (>=2.0.0, <=2.0.2)

dompurify NPM version =2.0.0, =0.0.1, =2.1.0, =2.2.0 Source cves: CVE-2019-16728 Source advisory: OSV:GHSA-CHQJ-J4FH-RW7M...

CSRF Vulnerability in polaris-website

Impact CSRF vulnerability: In some very specific circumstances, an attacker would be able to update your settings. Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your...

PT-2020-21558

Name of the Vulnerable Software and Affected Versions Polaris-React versions prior to 1.1.1 Description A CSRF vulnerability allows an attacker to update user settings under specific circumstances. The attacker would need the user to navigate to a malicious site while logged into the panel. The...

react-native-fast-image information disclosure vulnerability

react-native-fast-image is an image loading and processing package by Canadian software developer Dylan Vann. An information disclosure vulnerability exists in react-native-fast-image, which can be exploited by an attacker to cause signature credentials or other session tokens to be disclosed to...

openSUSE Security Update : SUSE Manager Client Tools (openSUSE-2020-1105)

This update fixes the following issues : dracut-saltboot : - Print a list of available disk devices bsc1170824 - Install wipefs to initrd - Force install crypt modules golang-github-prometheus-prometheus : - Update change log and spec file + Modified spec file: default to golang 1.14 to avoid 'ha...

CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

Authorization

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

CVE-2020-7696

The CVE-2020-7696 entry affects all versions of react-native-fast-image. When an image is loaded with headers that include sensitive data (e.g., host and authorization in the request headers), subsequent images reuse those headers, causing potential leakage of signing credentials or session token...

CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

CVE-2020-7696 Information Exposure

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...

CVE-2020-7696

This affects all versions of package react-native-fast-image. When an image with source=uri: "...", headers: host: "somehost.com", authorization: "..." is loaded, all other subsequent images will use the same headers, this can lead to signing credentials or other session tokens being leaked to...