7380 matches found
CVE-2025-64767 hpke-js reuses AEAD nonces
hpke-js is a Hybrid Public Key Encryption HPKE module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal calls. This can lead to complete loss of Confidentiality...
CVE-2025-64762 authkit-nextjs may let session cookies be cached in CDNs
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enable...
CVE-2025-64762 authkit-nextjs may let session cookies be cached in CDNs
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In authkit-nextjs version 2.11.0 and below, authenticated responses do not defensively apply anti-caching headers. In environments where CDN caching is enable...
CVE-2025-63700
An issue was discovered in clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage. NOTE: this is disputed by the Supplier because there is no available information to reproduce the issue, and because an OAuth...
CVE-2025-64767: Reusing a Nonce, Key Pair in Encryption
hpke-js is a Hybrid Public Key Encryption HPKE module built on top of Web Cryptography API. Prior to version 1.7.5, the public SenderContext Seal API has a race condition which allows for the same AEAD nonce to be re-used for multiple Seal calls. This can lead to complete loss of Confidentiality...
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage
An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage...
@billyjacoby/clerk-react-native (>=1.0.0, <=1.0.4), @breakthroughsales/chrome-extension-remote-code-load-fix (>=1.0.16, <=1.0.22) +9 more potentially affected by CVE-2025-63700 via @clerk/clerk-js (>=5.0.0-alpha-v5.0, <=5.85.0)
@clerk/clerk-js NPM version =5.0.0-alpha-v5.0, =1.0.0, =1.0.16, =0.0.1-canary.v7ae5681, =1.0.0-alpha-v5.0, =1.0.0-alpha-v5.0, =0.1.0, =0.4.2, =0.0.0-snapshot-20240531221728, =1.0.17, =0.8.0, =0.0.0-1765923, =0.23.2 Source cves: CVE-2025-63700 Source advisory: GHSA-3MM3-WFPV-Q85G...
GHSA-3MM3-WFPV-Q85G Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage
An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage...
@billyjacoby/clerk-react-native (>=1.0.0, <=1.0.4), @breakthroughsales/chrome-extension-remote-code-load-fix (>=1.0.16, <=1.0.22) +9 more potentially affected by CVE-2025-63700 via @clerk/clerk-js (>=5.0.0-alpha-v5.0, <=5.85.0)
@clerk/clerk-js NPM version =5.0.0-alpha-v5.0, =1.0.0, =1.0.16, =0.0.1-canary.v7ae5681, =1.0.0-alpha-v5.0, =1.0.0-alpha-v5.0, =0.1.0, =0.4.2, =0.0.0-snapshot-20240531221728, =1.0.17, =0.8.0, =0.0.0-1765923, =0.23.2 Source cves: CVE-2025-63700 Source advisory: OSV:GHSA-3MM3-WFPV-Q85G...
CVE-2025-63700
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2025-62295: Improper Neutralization of Input During Web Page Generation
SOPlanning is vulnerable to Stored XSS in /groupeform endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...
CVE-2025-62296: Improper Neutralization of Input During Web Page Generation
SOPlanning is vulnerable to Stored XSS in /taches endpoint. Malicious attacker with medium privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when opening editor. This issue was fixed in version 1.55...
PT-2025-62937
An issue was discovered in Clerk-js 5.88.0 allowing attackers to bypass the OAuth authentication flow by manipulating the request at the OTP verification stage...
CVE-2025-62729: Improper Neutralization of Input During Web Page Generation
SOPlanning is vulnerable to Stored XSS in /status endpoint. Malicious attacker with an account can inject arbitrary HTML and JS into website, which will be rendered/executed when opening multiple pages. This issue was fixed in version 1.55...
PT-2025-47504
Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 136 Description The esm.sh CDN service has an issue where CSS-to-JavaScript module conversion lacks proper sanitization. When a CSS file is requested with the ?module parameter, it is converted to a JavaScript module,...
Security Bulletin:IBM WebSphere Application Server Liberty shipped with IBM OpenPages has vulnerable crypto.js package (CVE-2020-36732)
Summary IBM WebSphere Application Server Liberty is shipped as a supporting program of IBM OpenPages. Information about crypto.js package vulnerability affecting IBM WebSphere Application Server Liberty has been published in a security bulletin. These products have addressed the applicable CVE. F...
CVE-2025-59115: Improper Neutralization of Input During Web Page Generation
Windu CMS is vulnerable to Stored Cross-Site Scripting XSS in the logon page where input data has no proper validation. Malicious attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting logs page by admin. Only version 4.1 was tested and confirmed as...
02.aula (1.0.0), 0xrtest (1.0.0) +8072 more potentially affected by CVE-2025-64718 via js-yaml (>=4.0.0, <=4.1.0)
js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.2.0, =0.14.0 and more Source cves: CVE-2025-64718 Source advisory: GHSA-MH29-5H37-FV8M...
02.aula (1.0.0), 0xrtest (1.0.0) +8072 more potentially affected by CVE-2025-64718 via js-yaml (>=4.0.0, <=4.1.0)
js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.2.0, =0.14.0 and more Source cves: CVE-2025-64718 Source advisory: OSV:GHSA-MH29-5H37-FV8M...