Malicious code in react-div-100vh-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9b9718c1f5170d44298bb0ef93d114e752ea42231e924e5c895add2f21e3c18a The OpenSSF Package Analysis project identified 'react-div-100vh-test' @ 9.0.0 npm as malicious. It is considered malicious because: - The packa...

SUSE CVE-2023-30609

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...

FreeBSD : element-web -- matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting (c676bb1b-e3f8-11ed-b37b-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c676bb1b-e3f8-11ed-b37b-901b0e9408dc advisory. - matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior ...

MAL-2023-626 Malicious code in nlp-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ef6692095c28b968172ac45d43937a7bfe30267c7c27add946d2534ad6c7e24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in nlp-react-native

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in nlp-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ef6692095c28b968172ac45d43937a7bfe30267c7c27add946d2534ad6c7e24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...

CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...

CVE-2023-30609

The CVE-2023-30609 issue affects matrix-react-sdk prior to version 3.71.0, where plain text messages containing HTML tags rendered in search results are treated as HTML. Exploitation requires tricking a user into searching for a specific message containing an HTML payload; the vulnerability is mi...

CVE-2023-30609 matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...

CVE-2023-30609

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...

matrix-react-skin (>=0.0.1, <=0.0.2), vector-web (0.3.0) potentially affected by CVE-2023-30609 via matrix-react-sdk (>=0.0.1, <=0.2.0)

matrix-react-sdk NPM version =0.0.1, =0.0.1, =0.0.2 - vector-web 0.3.0 Source cves: CVE-2023-30609 Source advisory: MEND:CVE-2023-30609...

CVE-2023-30609

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...

PT-2023-22806

Name of the Vulnerable Software and Affected Versions matrix-react-sdk versions prior to 3.71.0 Description The issue concerns plain text messages containing HTML tags being rendered as HTML in search results. An attacker would need to trick a user into searching for a specific message with an HT...

CVE-2023-30609: Improper Neutralization of Special Elements in Output Used by a Downstream Component

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching for a specific message...

element-web -- matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

Matrix developers report: matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user into searching...

Race Condition

@web3-react is vulnerable to a Race Condition. In the event that the user switches chains during the connection flow, the chainId may become outdated, making any data generated from it potentially inaccurate. An application that swaps between chains for instance, can cause the user to tokens mone...

MAL-2023-732 Malicious code in react-pop-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82e661a58f3aee5ad272c3708af6c6e28dc3abe886645d487831298be30ff64e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in react-pop-tooltip

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in react-pop-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82e661a58f3aee5ad272c3708af6c6e28dc3abe886645d487831298be30ff64e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...