Information Disclosure

next-auth is vulnerable to information disclosure. A local authenticated attacker is able to gain access to confidential information such as identity provider's classified data from the log through error handling of oAuthCallback function...

Authorization Bypass

next-auth is vulnerable to authorization bypass. The vulnerability exists because the email verification in email provider is not properly handled, allowing an attacker to bypass the mail address and log as a newly created user into the system...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-35924 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-35924 Source advisory: OSV:GHSA-XV97-C62V-4587...

GHSA-XV97-C62V-4587 NextAuth.js before 4.10.3 and 3.29.10 sending verification requests (magic link) to unwanted emails

Impact next-auth users who are using the EmailProvider either in versions before 4.10.3 or 3.29.10 are affected. If an attacker could forge a request that sent a comma-separated list of emails eg.: [email protected],[email protected] to the sign-in endpoint, NextAuth.js would send emails to...

CVE-2022-31186

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in "next-auth" before "v4.10.2" and "v3.29.9" allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the l...

CVE-2022-31186 Leakage of excessive information into log in next-auth

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

PT-2022-20596 · Next-Auth · Next-Auth

Name of the Vulnerable Software and Affected Versions: next-auth versions prior to v4.10.2 next-auth versions prior to v3.29.9 Description: An information disclosure issue allows an attacker with log access privilege to obtain excessive information, such as an identity provider's secret in the lo...

CVE-2022-31186: Insertion of Sensitive Information into Log File

NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...

PT-2022-33131

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.14.289 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb, which can be entered with an empty rx queue. The actual impact and attack plausibility...

PT-2022-32463

Name of the Vulnerable Software and Affected Versions xen/netback versions prior to v5.18.13 Description The issue is related to the xen/netback component, where it may enter the xenvif rx next skb function with an empty rx queue. The actual impact and attack plausibility have not yet been proven...

PT-2022-33063

Name of the Vulnerable Software and Affected Versions xen/netback versions prior to v4.19.253 Description The issue is related to the xen/netback component, where it may enter the xenvif rx next skb function with an empty rx queue. The actual impact and attack plausibility have not yet been prove...

PT-2022-33182

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v4.9.324 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb, which can be entered with an empty rx queue. The actual impact and attack plausibility ha...

PT-2022-32679

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.15.56 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb, which can be entered with an empty rx queue. The actual impact and attack plausibility ha...

PT-2022-32974

Name of the Vulnerable Software and Affected Versions xen/netback versions prior to v5.4.207 Linux Kernel versions v4.9 through v5.4.206 Description The issue is related to the xen/netback component, specifically with the function xenvif rx next skb. It is possible to enter this function with an...

CVE-2021-33446

An issue was discovered in mjs mJS: Restricted JavaScript engine, ES6 JavaScript version 6. There is NULL pointer dereference in mjsnext in mjs.c...

PT-2022-10242

Name of the Vulnerable Software and Affected Versions mjs affected versions not specified Description An issue was discovered in mjs, a Restricted JavaScript engine, specifically in ES6 JavaScript version 6, where there is a NULL pointer dereference in the mjs next function in mjs.c...

Green Alliance NF firewall has information leakage vulnerability

Green Alliance NF Firewall is an enterprise-class next-generation border security product constructed by Green Alliance Technology on the basis of the latest generation 64-bit multi-core hardware platform, combined with the application layer security protection concept and high-speed packet...

PT-2025-25949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been identified where the kernel will crash if an interrupt is raised when there is no descriptor in the channel. This is resolved by checking the result ...

CVE-2022-34028

Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsutf8next at src/njsutf8.h...

PT-2022-3707

Name of the Vulnerable Software and Affected Versions Nginx NJS version 0.7.5 Description The issue is related to a segmentation violation via the njs utf8 next function at src/njs utf8.h. This can lead to a buffer overflow in memory, potentially allowing a remote attacker to execute arbitrary...