Software supply chain failures and mishandling of exceptional conditions are some of the additions to the updated OWASP Top 10, a list of top web application vulnerabilities. Most of the list has remained unchanged since 2021. In fact, the top item, broken access control, has been on the Open Worldwide Application Security Project’s list since…
Category: Security, Software Development, Vulnerabilities
Exploits, Global Security News, Security, Software Development, Vulnerabilities
RCE in React Native CLI opens Dev Servers to attacks
A critical remote-code execution (RCE) flaw in the widely used @react-native-community/cli (and its server API) lets attackers run arbitrary OS commands via the Metro development server, the default JavaScript bundler for React Native. In essence, launching the development server through standard commands (eg, npm start or npx react-native start) could expose the machine to external…