React Native Sms User Consent 安全漏洞

React Native Sms User Consent is an open source library by Kyivstar Tech Digital. A security vulnerability exists in React Native Sms User Consent 1.1.4 and earlier versions, which stems from a security issue in the registerReceiver function in...

Malicious code in espn-react-oneid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4692f32d575cbdbf797aea5aabd0d50c4015884bfac1ce7b40006443bd8759f6 The OpenSSF Package Analysis project identified 'espn-react-oneid' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1129 Malicious code in espn-react-oneid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4692f32d575cbdbf797aea5aabd0d50c4015884bfac1ce7b40006443bd8759f6 The OpenSSF Package Analysis project identified 'espn-react-oneid' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in eng-intern-assessment-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89b4034292e246b7a29d48d5132016c2ae8beb78c0b6a0794d515aa811e5cc59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1118 Malicious code in eng-intern-assessment-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89b4034292e246b7a29d48d5132016c2ae8beb78c0b6a0794d515aa811e5cc59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1116 Malicious code in custom-banner-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34d3a0ada39e2fd82258a3fc7c24701af1389dc5d9de771dd18d930e9ccc2ad3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frosmo-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49ad426e0403cbb83406507bc9ee1c54e3c62183174858cd77bd8d4f0d52cbd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Information Disclosure

@sentry/react-native is vulnerable to Information Disclosure. The vulnerability is due to allowing auth tokens to be set in the optional authToken configuration parameter. This flaw potentially leads to Information Disclosure when built into the application bundle and published...

BloodHound - Six Degrees Of Domain Admin

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound uses graph...

minibili (>=0.3.0, <=0.3.1), perf-hook (>=1.0.1, <=1.0.4) +2 more potentially affected by unknown CVE via @sentry/react-native (>=5.16.0, <=5.17.0)

@sentry/react-native NPM version =5.16.0, =0.3.0, =1.0.1, =1.2.3, =1.2.7 - sentry-expo 7.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-68C2-4MPX-QH95...

GHSA-68C2-4MPX-QH95 Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin

Impact SDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes. Doing so would result in the auth token being built into the application bundle, and therefore the auth token could be...

Potential leakage of Sentry auth tokens by React Native SDK with Expo plugin

Impact SDK versions between and including 5.16.0 and 5.19.0 allowed Sentry auth tokens to be set in the optional authToken configuration parameter, for debugging purposes. Doing so would result in the auth token being built into the application bundle, and therefore the auth token could be...

@bundly/ic-core-js (>=0.1.0, <=0.4.2-rc.4), @bundly/ic-react (>=0.1.0, <=0.4.2-rc.4) +8 more potentially affected by CVE-2024-1631 via @dfinity/auth-client (>=0.20.2, <=0.21.4)

@dfinity/auth-client NPM version =0.20.2, =0.1.0, =0.1.0, =0.1.1, =0.0.1, =0.0.1, =0.0.3, =0.0.2, =0.0.38-next-2023-12-19, =0.0.1, =0.0.7 Source cves: CVE-2024-1631 Source advisory: OSV:GHSA-C9VV-FHGV-CJC3...

@apolitical/component-library (>=1.7.0-beta.1, <=10.5.0), @apolitical/styleguide2 (>=3.17.0-rc.1, <=7.8.1) +60 more potentially affected by CVE-2024-21535 via markdown-to-jsx (>=7.0.0, <=7.3.2)

markdown-to-jsx NPM version =7.0.0, =1.7.0-beta.1, =3.17.0-rc.1, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =6.1.1, =7.3.2, =0.1.0, =0.9.1, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =0.1.0-alpha.39, =1.1.1-beta.3, =1.2.2 and more Source cves: CVE-2024-21535 Source advisory:...

GHSA-PMGM-H3CC-M4HJ React Native Document Picker Directory Traversal vulnerability

Directory Traversal vulnerability in React Native Document Picker before 8.2.2 and 9.x before 9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

@icanbwell/composite (>=1.89.4, <=1.202.0), @icanbwell/native-components (>=0.21.6, <=0.31.0) +4 more potentially affected by CVE-2024-25466 via react-native-document-picker (>=9.0.1, <=9.1.0)

react-native-document-picker NPM version =9.0.1, =1.89.4, =0.21.6, =0.14.5, =1.1.0, =1.8.0 - @likeminds.community/feed-rn-core 0.6.0 - @likeminds.community/feed-rn-core-beta 0.0.1 Source cves: CVE-2024-25466 Source advisory: OSV:GHSA-PMGM-H3CC-M4HJ...

React Native Document Picker Directory Traversal vulnerability

Directory Traversal vulnerability in React Native Document Picker before 8.2.2 and 9.x before 9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

@kafudev/react-native-shell (>=0.66.4-beta.18, <=0.66.5-beta.8), @likeminds.community/chat-rn-core (>=0.5.0, <=1.0.1) +4 more potentially affected by CVE-2024-25466 via react-native-document-picker (>=8.0.0, <=8.2.0)

react-native-document-picker NPM version =8.0.0, =0.66.4-beta.18, =0.5.0, =0.0.8, =0.0.1, =0.5.0, =0.5.14 - yan-react-hook-form 0.1.7 Source cves: CVE-2024-25466 Source advisory: OSV:GHSA-PMGM-H3CC-M4HJ...

CVE-2024-25466

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...

Directory traversal

Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbitrary code via a crafted script to the Android library component...