CVE-2023-3294 Cross-site Scripting (XSS) - DOM in saleor/react-storefront

Cross-site Scripting XSS - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7...

react-storefront 跨站脚本漏洞

react-storefront is a Saleor open source React.js open source storefront with Next.js. A cross-site scripting vulnerability exists in react-storefront. An attacker exploits this vulnerability to perform stored cross-site scripting XSS attacks...

CVE-2023-3294

CVE-2023-3294 corresponds to a DOM-based XSS in saleor/react-storefront (GitHub repo) prior to the commit c29aab226f07ca980cc19787dcef101e11b83ef7. Multiple sources (NVD, Red Hat, OSV, CVE listings, Huntr) describe a cross-site scripting vulnerability in the React storefront with potential user i...

CVE-2023-3294 Cross-site Scripting (XSS) - DOM in saleor/react-storefront

Cross-site Scripting XSS - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7...

CVE-2023-3294 Cross-site Scripting (XSS) - DOM in saleor/react-storefront

Cross-site Scripting XSS - DOM in GitHub repository saleor/react-storefront prior to c29aab226f07ca980cc19787dcef101e11b83ef7...

Malicious code in tslib-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ef2c27850230a6ec89e578f414b36de97f9850b32450c33921cb68699cf3ba38 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-733 Malicious code in react-router-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 329da6645c0b4c1b67bd28d5bc5b0cde6725f995276a8a0e93bed30b180921ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-router-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 329da6645c0b4c1b67bd28d5bc5b0cde6725f995276a8a0e93bed30b180921ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-34245

@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into th...

CVE-2023-34245 Cross site scripting (XSS) in @udecode/plate-link

@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into th...

CVE-2023-34245 Cross site scripting (XSS) in @udecode/plate-link

@udecode/plate-link is the link handler for the udecode/plate rich-text editor plugin system for Slate & React. Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the javascript: scheme. As a result, links with JavaScript URLs can be inserted into th...

CVE-2023-34245

The CVE-2023-34245 issue affects @udecode/plate-link, the link handler for the Plate editor (Slate/React). Affected versions allow JavaScript: URLs to be rendered into the DOM due to inadequate URL sanitization, enabling potential XSS through links inserted by various means. The patch in plate-li...

CVE-2023-34238

Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the file-code-frame and original-stack-frame paths, exposed when running the Gatsby develop server gatsby develop. Any file in scope o...

Design/Logic Flaw

Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the file-code-frame and original-stack-frame paths, exposed when running the Gatsby develop server gatsby develop. Any file in scope o...

CVE-2023-34238 Local File Inclusion vulnerability in Gatsby

Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the file-code-frame and original-stack-frame paths, exposed when running the Gatsby develop server gatsby develop. Any file in scope o...

CVE-2023-34238

Gatsby (React-based framework) prior to versions 4.25.7 and 5.9.1 contains a Local File Inclusion (LFI) vulnerability in the __file-code-frame and __original-stack-frame paths when the Gatsby develop server is run. The issue could expose any file on the development server’s scope, with exploitati...

CVE-2023-34238 Local File Inclusion vulnerability in Gatsby

Gatsby is a free and open source framework based on React. The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the file-code-frame and original-stack-frame paths, exposed when running the Gatsby develop server gatsby develop. Any file in scope o...

Malicious Package

Overview react-influxdb is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious Package

Overview plugin-react-hooks is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview react-hook-form-deprecated is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...