Malicious code in react-navigation-area-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc67ff72904c84b476e3f102ad2d7c61225b500ed7e1dc8852166e2c1b88c694 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7924 Malicious code in @webview/react-skeletor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 756497fc47f785eae2c52c2c51d75ea29cbe95f6208c9d4c8b4ad576408efb7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-41167

@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers. This is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. Webiny is an open-source serverless enterprise CMS. The @webiny/react-rich-text-renderer package depends on the...

CVE-2023-41167

CVE-2023-41167 affects @webiny/react-rich-text-renderer (pre-5.37.2). The vulnerability arises from rendering rich text content via dangerouslySetInnerHTML without HTML sanitization, allowing XSS when a content manager injects malicious input into Webiny CMS/Form Builder data that is later render...

GHSA-3X59-VRMC-5MX6 @webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content

Overview @webiny/react-rich-text-renderer is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. The @webiny/react-rich-text-renderer package depends on the editor.js rich text editor to handle rich text content. The CMS stores rich text content from the...

@webiny/react-rich-text-renderer vulnerable to insecure rendering of rich text content

Overview @webiny/react-rich-text-renderer is a react component to render data coming from Webiny Headless CMS and Webiny Form Builder. The @webiny/react-rich-text-renderer package depends on the editor.js rich text editor to handle rich text content. The CMS stores rich text content from the...

Malicious code in react-vis-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6b50bcb70f028287514bfdeca61e58907a79b80687a92a949e45abc009d38974 The OpenSSF Package Analysis project identified 'react-vis-master' @ 1.12.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1536 Malicious code in react-vis-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6b50bcb70f028287514bfdeca61e58907a79b80687a92a949e45abc009d38974 The OpenSSF Package Analysis project identified 'react-vis-master' @ 1.12.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in stripe-identity-react-native-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb5d2bc0139deaa57cabe88a2bee12171f6b1348c6a8ae5227efd82ec4a556af The OpenSSF Package Analysis project identified 'stripe-identity-react-native-example' @ 1.0.0 npm as malicious. It is considered malicious...

MAL-2023-1535 Malicious code in stripe-identity-react-native-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb5d2bc0139deaa57cabe88a2bee12171f6b1348c6a8ae5227efd82ec4a556af The OpenSSF Package Analysis project identified 'stripe-identity-react-native-example' @ 1.0.0 npm as malicious. It is considered malicious...

CVE-2023-40027

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

Default configuration

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

CVE-2023-40027 Conditionally missing authorization in @keystone-6/core

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

CVE-2023-40027

Keystone (Node.js) vulnerability CVE-2023-40027: When ui.isAccessAllowed is undefined, the adminMeta GraphQL query is publicly accessible without a session, potentially exposing admin metadata. Affected users are those relying on a session strategy to restrict access; developers using @keystone-6...

CVE-2023-40027 Conditionally missing authorization in @keystone-6/core

Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When ui.isAccessAllowed is set as undefined, the adminMeta GraphQL query is publicly accessible no session required. This is different to the behaviour of the default AdminUI middleware, which by default will only...

@primecms/core (>=0.0.23, <=0.3.3-beta.9), @primecms/field-string (>=0.0.23, <=0.3.4-beta.1) +7 more potentially affected by CVE-2021-27524 via braft-editor (>=2.1.34, <=2.3.8)

braft-editor NPM version =2.1.34, =0.0.23, =0.0.23, =0.1.0, =0.9.4-rc.0, =0.1.0-beta, =0.4.11-beta.0, =0.4.26 Source cves: CVE-2021-27524 Source advisory: OSV:GHSA-JFRF-VV54-J2JG...

MAL-2023-1440 Malicious code in react-dropzone-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2617d06d7f7e79da19c8a24acc1e620c9a46dcf8b6a5087f482081c2badff0de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-dropzone-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2617d06d7f7e79da19c8a24acc1e620c9a46dcf8b6a5087f482081c2badff0de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-native-transparent-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfc4c56c3c11c9b9f70d9cc95f941b8549be2b5b18c367c51ed8d531cb0f2ca6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1441 Malicious code in react-native-transparent-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfc4c56c3c11c9b9f70d9cc95f941b8549be2b5b18c367c51ed8d531cb0f2ca6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...