CVE-2021-31712

react-draft-wysiwyg aka React Draft Wysiwyg before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS...

@1studio/ui (>=1.0.7, <=2.83.0), @cloudacademy/integrations (>=0.0.2, <=0.0.15) +51 more potentially affected by CVE-2021-31712 via react-draft-wysiwyg (>=1.10.0, <=1.14.5)

react-draft-wysiwyg NPM version =1.10.0, =1.0.7, =0.0.2, =2.1.15, =0.1.0, =1.0.0, =1.0.0-rc.1.0.0, =0.1.1, =0.1.5, =0.8.6, =0.0.15, =2.1.19, =1.0.0, =0.10.5, =0.0.8, =0.2.5 and more Source cves: CVE-2021-31712 Source advisory: MEND:CVE-2021-31712...

CVE-2021-31712

react-draft-wysiwyg aka React Draft Wysiwyg before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS...

CVE-2021-31712: Improper Neutralization of Input During Web Page Generation

react-draft-wysiwyg aka React Draft Wysiwyg before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS...

PT-2021-19480

Name of the Vulnerable Software and Affected Versions react-draft-wysiwyg versions prior to 1.14.6 Description The issue allows a javascript: URI in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS. Recommendations For versions...

react-draft-wysiwyg 跨站脚本漏洞

react-draft-wysiwyg is an application. Wysiwyg editor built with ReactJS and DraftJS libraries. A cross-site scripting vulnerability exists in react-draft-wysiwyg versions prior to 1.14.6, which stems from allowing a javascript: URi in decorators/Link/index.js...

Improper Authentication in react-adal

This affects versions of react-adal 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by h...

GHSA-7MPX-VG3C-CMR4 Improper Authentication in react-adal

This affects versions of react-adal 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by h...

@joshmccall/atomic-stories (>=0.0.0-semantically-released, <=1.9.5), abmcontent (0.1.0) +3 more potentially affected by CVE-2020-7787 via react-adal (>=0.3.15, <=0.4.24)

react-adal NPM version =0.3.15, =0.0.0-semantically-released, =0.1.0, =0.1.3 - widgettestcomponent 0.1.0 Source cves: CVE-2020-7787 Source advisory: OSV:GHSA-7MPX-VG3C-CMR4...

@joshmccall/atomic-stories (>=0.0.0-semantically-released, <=1.9.5), abmcontent (0.1.0) +3 more potentially affected by CVE-2020-7787 via react-adal (>=0.3.15, <=0.4.24)

react-adal NPM version =0.3.15, =0.0.0-semantically-released, =0.1.0, =0.1.3 - widgettestcomponent 0.1.0 Source cves: CVE-2020-7787 Source advisory: GHSA-7MPX-VG3C-CMR4...

@concepto/eb (>=1.1.7, <=1.1.95), @concepto/nuxt (1.9.427) +6 more potentially affected by CVE-2019-10804 via serial-number (1.3.0)

serial-number NPM version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on serial-number and may be impacted: - @concepto/eb =1.1.7, =0.0.1, =1.9.35, =1.1.0, =0.6.1, =2.5.0, =3.1.1 Source cves: CVE-2019-10804 Source advisory: OSV:GHSA-3FW4-4H3M-89...

@gsandf/react-native-oauth (>=2.1.16, <=2.2.2), react-native-oauth (>=1.1.0, <=2.2.0) +5 more potentially affected by CVE-2019-10805 via valib (2.0.0)

valib NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on valib and may be impacted: - @gsandf/react-native-oauth =2.1.16, =1.1.0, =2.1.16, =2.1.15, =0.1.0, =0.4.6 Source cves: CVE-2019-10805 Source advisory: GHSA-PMPR-VC5Q-H3JW...

@gsandf/react-native-oauth (>=2.1.16, <=2.2.2), react-native-oauth (>=1.1.0, <=2.2.0) +5 more potentially affected by CVE-2019-10805 via valib (2.0.0)

valib NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on valib and may be impacted: - @gsandf/react-native-oauth =2.1.16, =1.1.0, =2.1.16, =2.1.15, =0.1.0, =0.4.6 Source cves: CVE-2019-10805 Source advisory: OSV:GHSA-PMPR-VC5Q-H3JW...

@jheubuch/ng-ws-template (>=1.0.1, <=1.0.2), pg-generator (>=3.5.0, <=4.8.3) +1 more potentially affected by CVE-2021-26275 via eslint-fixer (0.1.5)

eslint-fixer NPM version 0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on eslint-fixer and may be impacted: - @jheubuch/ng-ws-template =1.0.1, =3.5.0, =4.8.3 - pg-generator-react-template 0.1.0 Source cves: CVE-2021-26275 Source advisory:...

@duetds/angular (>=5.0.2, <=5.0.3), @duetds/components (>=5.0.2, <=5.0.3) +2 more potentially affected by CVE-2021-23356 via kill-process-by-name (1.0.5)

kill-process-by-name NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on kill-process-by-name and may be impacted: - @duetds/angular =5.0.2, =5.0.2, =1.7.20, =5.0.2, =5.0.3 Source cves: CVE-2021-23356 Source advisory: OSV:GHSA-QC65-CGVR-9...

@duetds/angular (>=5.0.2, <=5.0.3), @duetds/components (>=5.0.2, <=5.0.3) +2 more potentially affected by CVE-2021-23356 via kill-process-by-name (1.0.5)

kill-process-by-name NPM version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on kill-process-by-name and may be impacted: - @duetds/angular =5.0.2, =5.0.2, =1.7.20, =5.0.2, =5.0.3 Source cves: CVE-2021-23356 Source advisory: GHSA-QC65-CGVR-93P6...

react-dev-utils OS Command Injection in function `getProcessForPort`

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +15380 more potentially affected by CVE-2021-24033 via react-dev-utils (>=0.4.0, <=11.0.3)

react-dev-utils NPM version =0.4.0, =1.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2, =1.0.3, =1.0.11 and more Source cves: CVE-2021-24033 Source advisory: OSV:GHSA-5Q6M-3H65-W53X...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +15380 more potentially affected by CVE-2021-24033 via react-dev-utils (>=0.4.0, <=11.0.3)

react-dev-utils NPM version =0.4.0, =1.0.1, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.2, =1.0.3, =1.0.11 and more Source cves: CVE-2021-24033 Source advisory: GHSA-5Q6M-3H65-W53X...

GHSA-5Q6M-3H65-W53X react-dev-utils OS Command Injection in function `getProcessForPort`

react-dev-utils prior to v11.0.4 exposes a function, getProcessForPort, where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts in Create React App projects, where the usage is safe. Only when this function is manually invok...