Information Disclosure

yarn is vulnerable to information disclosure. The attack is possible because it does not use a secure connection for regular registries, allowing a man-in-the-middle to disclose and manipulate the sensitive information...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

DEBIAN-CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

Authentication flaw

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

UBUNTU-CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

CVE-2019-5448

CVE-2019-5448 affects Yarn; the vulnerability arises from HTTP URLs in a Yarn lockfile that can cause unencrypted authentication data to be transmitted. The connected advisories confirm Photon OS and Nessus plugins flag Yarn as affected and advise updating the Yarn package to mitigate. The exact ...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

CVE-2019-5448

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network...

Node.js third-party modules: Yarn transfers npm credentials over unencrypted http connection

Module module name: yarn version: 1.16.0 npm page: https://www.npmjs.com/package/yarn Module Description Fast, reliable, and secure dependency management. Module Stats Replace stats below with numbers from npm’s module page: 166 703 downloads in the last day 849 928 downloads in the last week 3 7...

@6river/rosbag (>=1.0.2-6river, <=1.1.0-browserOrNode.2), @jamesbliss/react-flickity (>=1.0.0, <=1.4.0) +26 more potentially affected by CVE-2019-5448 via yarn (>=1.0.2, <=1.16.0)

yarn NPM version =1.0.2, =1.0.2-6river, =1.0.0, =1.9.9-1, =1.0.0, =1.0.21, =8.3.8, =0.1.0, =3.0.0, =0.0.0-semantic-release, =1.9.7, =5.0.0-ts.4, =0.0.4, =0.0.14 and more Source cves: CVE-2019-5448 Source advisory: SNYK:JS-YARN-451571...

Man-in-the-Middle (MitM)

Overview yarn is a package for dependency management. Affected versions of this package are vulnerable to Man-in-the-Middle MitM. Npm credentials such as authToken were found to be sent over clear text when processing scoped packages that are listed as resolved. This could allow a suitably...

CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn...

CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn...

UBUNTU-CVE-2018-12556

The signature verification routine in install.sh in yarnpkg/website through 2018-06-05 only verifies that the yarn release is signed by any arbitrary key in the local keyring of the user, and does not pin the signature to the yarn release key, which allows remote attackers to sign tampered yarn...

CVE-2018-12556

CVE-2018-12556 affects the yarnpkg/website install.sh signature verification: it only checks that the release is signed by any key in the user’s local keyring, not pinned to the yarn release key, enabling remote attackers to sign tampered yarn packages with their own key. Public documents note un...

Yarn Package Manager Tampering Vulnerability

Yarn Package Manager is a package manager. A security vulnerability exists in Yarn Package Manager, which stems from the program not performing any form of certificate locking and trust management. The vulnerability can be exploited to execute code by replacing the original installation package...

SpeakUp Linux Backdoor Sets Up for Major Attack

LAS VEGAS — A backdoor trojan dubbed “SpeakUp” has been spotted exploiting the Linux servers that run more than 90 percent of the top 1 million domains in the U.S. It uses a complex bag of tricks to infect hosts and to propagate, which analysts say could indicate that it’s poised for a major...

Arbitrary Command Execution in Hadoop

In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user...