Command Injection

Amendment This was deemed not a vulnerability. Overview git-revision-webpack-plugin is a simple webpack plugin that generates version and commithash files during build based on a local git repository. Affected versions of this package are vulnerable to Command Injection. The function commithash...

Denial Of Service (DoS)

webpack-dev-middleware is vulnerable to denial of service. A memory leak occurs when the function writeToDisk is used, causing the compile-time to keep increasing as the duplicates write to disk keep increasing, eventually leading to a denial of service condition...

@500tech/react-scripts (>=3.0.0-alpha.8, <=5.1.0), @51npm/freedom-middleware-webpack4 (>=1.0.0, <=1.1.0) +149 more potentially affected by unknown CVE via webpack-bundle-analyzer (>=3.0.1, <=3.2.0)

webpack-bundle-analyzer NPM version =3.0.1, =3.0.0-alpha.8, =1.0.0, =0.9.0, =0.0.1-canary.49, =0.1.0, =9.0.0, =2.0.0-1, =1.12.0, =0.3.0, =1.0.0-1.0.0-beta.34.0, =0.1.0, =6.0.0-alpha.1, =0.0.1, =1.0.0, =0.0.1-alpha.151, =0.0.1-alpha.153 and more Source cves: unknown CVE Source advisory:...

GHSA-PGR8-JG6H-8GW6 Cross-Site Scripting in webpack-bundle-analyzer

Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify without properly escaping input which may lead to Cross-Site Scripting. Recommendation Upgrade to version 3.3.2 or later...

Cross-Site Scripting in webpack-bundle-analyzer

Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify without properly escaping input which may lead to Cross-Site Scripting. Recommendation Upgrade to version 3.3.2 or later...

PT-2019-20063

Name of the Vulnerable Software and Affected Versions webpack-bundle-analyzer versions prior to 3.3.2 Description The issue concerns Cross-Site Scripting due to the improper use of JSON.stringify without escaping input, which may lead to security risks. Recommendations Upgrade to version 3.3.2 or...

Cross-Site Scripting

Overview Versions of webpack-bundle-analyzer prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses JSON.stringify without properly escaping input which may lead to Cross-Site Scripting. Recommendation Upgrade to version 3.3.2 or later. References - GitHub PR - Snyk Report - GitH...

@enact/cli (>=0.9.6, <=0.9.8), abt.api.web (0.0.3) +28 more potentially affected by CVE-2018-6342 via react-dev-utils (>=3.0.0, <=3.1.1)

react-dev-utils NPM version =3.0.0, =0.9.6, =4.2.0, =1.5.1, =0.15.0, =0.7.0, =0.7.0, =0.1.0, =0.1.4, =1.9.2, =0.0.1, =0.0.1, =0.0.3 and more Source cves: CVE-2018-6342 Source advisory: OSV:GHSA-29GP-92WP-94Q8...

@5minutes2start/react-scripts (>=1.1.2, <=1.1.4), @biko/react-scripts (>=0.1.0, <=0.4.0) +132 more potentially affected by CVE-2018-6342 via react-dev-utils (>=4.0.0, <=4.2.1)

react-dev-utils NPM version =4.0.0, =1.1.2, =0.1.0, =0.8.12, =0.1.0, =0.0.1, =2.13.0, =2.14.0, =0.2.0, =0.3.0, =0.2.2, =0.2.10-SNAPSHOT.481, =0.2.10-SNAPSHOT.673 - @leizeng/react-scripts-ts 2.13.0 and more Source cves: CVE-2018-6342 Source advisory: OSV:GHSA-29GP-92WP-94Q8...

@1337lawyers/design (>=0.1.0, <=0.1.38), @9188/w-cli (>=1.0.0, <=1.0.4) +50 more potentially affected by CVE-2018-6342 via react-dev-utils (>=5.0.0, <=5.0.1)

react-dev-utils NPM version =5.0.0, =0.1.0, =1.0.0, =0.4.1, =0.1.0-latest.1a450bb3, =1.0.5, =1.0.0-beta.28, =1.0.1, =1.0.0, =1.0.0, =0.26.4, =0.0.0-legacy, =3.10.0-beta.0, =0.1.0-alpha.0, =2.1.16, =2.3.5 - aqxy-common-ui 0.0.1 and more Source cves: CVE-2018-6342 Source advisory:...

GHSA-CF66-XWFP-GVC4 Missing Origin Validation in webpack-dev-server

Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...

2muchcoffee-react-scripts (0.1.0), 2muchcoffee-react-scripts2 (>=0.1.0, <=0.1.2) +993 more potentially affected by CVE-2018-14732 via webpack-dev-server (>=3.0.0, <=3.1.10)

webpack-dev-server NPM version =3.0.0, =0.1.0, =0.6.2, =2.1.1, =0.1.0, =1.0.0, =2.1.0-beta.0, =2.1.0-beta.0, =2.1.2-4, =2.2.0-beta.1, =1.0.0, =0.8.8, =0.12.0 and more Source cves: CVE-2018-14732 Source advisory: OSV:GHSA-CF66-XWFP-GVC4...

Missing Origin Validation in webpack-dev-server

Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not validated...

Node.js third-party modules: [webpack-bundle-analyzer] Cross-site Scripting

I would like to report Cross-site Scripting in webpack-bundle-analyzer. It allows injecting and executing arbitray JavaScript code. Module module name: webpack-bundle-analyzer version: 3.0.3 npm page: https://www.npmjs.com/package/webpack-bundle-analyzer Module Description Visualize size of webpa...

Missing Origin Validation

Overview Versions of webpack-dev-server before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement HMR are not...

Code Sniffing

webpack-dev-server is vulnerable to Code Sniffing. The code sniffing is possible because WebSocket server for HMR Hot Module Replacement does not validate the origin of the request, allowing unauthorised users to access HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connectio...

CVE-2018-14732

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket...

CVE-2018-14732

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket...

Code injection

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket...

CVE-2018-14732

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR Hot Module Replacement. Anyone can receive the HMR message sent by the WebSocket...