web3-react race condition issues

web3-react is a simple, maximally scalable, dependency-minimizing framework for building modern ethereum dApps. web3-react suffers from a Competing Conditions Issue vulnerability that stems from the fact that any data derived from a chainId may be incorrect if a user changes the chain during the...

PT-2023-22770 · Npm · @Web3-React/Eip1193 +4

Name of the Vulnerable Software and Affected Versions: @web3-react versions prior to the updated npm artifacts Description: The chainId may be outdated if the user changes chains as part of the connection flow, causing the value of chainId returned by useWeb3React to be incorrect. This can lead t...

matrix-react-sdk (>=3.69.0, <=3.70.0-rc.1) potentially affected by CVE-2023-29529 via matrix-js-sdk (>=24.0.0, <=24.1.0-rc.1)

matrix-js-sdk NPM version =24.0.0, =3.69.0, =3.70.0-rc.1 Source cves: CVE-2023-29529 Source advisory: OSV:GHSA-6G67-Q39G-R79Q...

matrix-react-sdk (>=3.69.0, <=3.70.0-rc.1) potentially affected by CVE-2023-29529 via matrix-js-sdk (>=24.0.0, <=24.1.0-rc.1)

matrix-js-sdk NPM version =24.0.0, =3.69.0, =3.70.0-rc.1 Source cves: CVE-2023-29529 Source advisory: GHSA-6G67-Q39G-R79Q...

Malware in @bingads-webui-campaign-react/labels-page

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview eos-react-components is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview react-sports is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview prism-subapps-react-common is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

Prototype Pollution

matrix-react-sdk is vulnerable to Prototype Pollution. The vulnerability exists because, in certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype which may lead to an application crash...

MAL-2023-735 Malicious code in react-sports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a36f3d3c020e8060abbc0f642934bed99c8594f79b7306030d885b0bd3a838d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-sports-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4dc4fa4bf228c9c09ee80e076570ba795f4bbf16efab3df7655ef3c27fa9993 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-sports (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a36f3d3c020e8060abbc0f642934bed99c8594f79b7306030d885b0bd3a838d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in react-sports

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in react-sports-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-736 Malicious code in react-sports-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4dc4fa4bf228c9c09ee80e076570ba795f4bbf16efab3df7655ef3c27fa9993 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Prototype pollution in matrix-react-sdk

Impact In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic. This is part 2, where...

CVE-2023-28103

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-react-sdk functionality, causing denial of service and...

CVE-2022-36060

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...

Design/Logic Flaw

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the Object.prototype, disrupting matrix-react-sdk functionality, causing denial of service and...

Design/Logic Flaw

matrix-react-sdk is a Matrix chat protocol SDK for React Javascript. Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear...