PT-2022-10242

Name of the Vulnerable Software and Affected Versions mjs affected versions not specified Description An issue was discovered in mjs, a Restricted JavaScript engine, specifically in ES6 JavaScript version 6, where there is a NULL pointer dereference in the mjs next function in mjs.c...

Green Alliance NF firewall has information leakage vulnerability

Green Alliance NF Firewall is an enterprise-class next-generation border security product constructed by Green Alliance Technology on the basis of the latest generation 64-bit multi-core hardware platform, combined with the application layer security protection concept and high-speed packet...

PT-2025-25949

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been identified where the kernel will crash if an interrupt is raised when there is no descriptor in the channel. This is resolved by checking the result ...

CVE-2022-34028

Nginx NJS v0.7.5 was discovered to contain a segmentation violation via njsutf8next at src/njsutf8.h...

PT-2022-3707

Name of the Vulnerable Software and Affected Versions Nginx NJS version 0.7.5 Description The issue is related to a segmentation violation via the njs utf8 next function at src/njs utf8.h. This can lead to a buffer overflow in memory, potentially allowing a remote attacker to execute arbitrary...

Nginx 安全漏洞

Nginx is a lightweight web server/reverse proxy server and email IMAP/POP3 proxy server from Nginx, Inc. njs is one of the scripting language components that supports extended NGINX functionality. A security vulnerability exists in Nginx NJS 0.7.5, which stems from a segmentation violation in...

EMEAR Monthly Talos Update: Training the next generation of cybersecurity researchers

Cisco Talos and Cisco Secure have the latest edition of the Talos EMEAR Threat Update series out now, which you can watch above or over at this link, where Martin Lee and Hazel Burton talk about the cybersecurity skills gap that currently exists and how we can better train the next generation of...

Security Bulletin: The IBM® SDK Java Technology Edition 8.0.7.5 contains additional security fixes that can be applied to IBM Continuous Engineering products based on IBM Jazz Technology

Summary There are security vulnerabilities that are addressed in the IBM® SDK Java Technology Edition 8.0.7.5. The following products: IBM Jazz Team Server affecting the following IBM Jazz Team Server based Applications: Collaborative Lifecycle Management CLM, Engineering Lifecycle Management ELM...

Open redirect when login successfully

Description Open redirect when login successfully via next parameter Proof of Concept POST /login?next=https://www.google.com/open-redirect HTTP/2 Host: book.dansmonorage.blue Cookie: csrftoken=EUjtgvt3A20lSHYbTxBvfAxQi5gNHHzeI7Bda1HOGnWCioMA6cwQqYWXv8ONog4k User-Agent: Mozilla/5.0 Windows NT 10....

PT-2022-37078

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-buffer-overflow read, which was identified through an OSS-Fuzz report. The crash state indicates the involvement of function...

Phishing Attack

next-auth is vulnerable to phishing attacks. A remote attacker is able to pass a specifically crafted input to the e-mail signin endpoint which contains malicious HTML, tricking the e-mail server to send it to the user which allows the attacker to perform phishing attacks on the victim...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-31127 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-31127 Source advisory: OSV:GHSA-PGJX-7F9G-9463...

GHSA-PGJX-7F9G-9463 Improper handling of email input

Impact An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: [email protected], Before signing in, claim your money!. This was previously sent to...

CVE-2022-31127: Improper Neutralization of Input During Web Page Generation

NextAuth.js is a complete open source authentication solution for Next.js applications. An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.:...

vim: buffer over-read in function find_next_quote

A flaw was found in vim, where it is vulnerable to a buffer over-read in the findnextquote function. This flaw allows a specially crafted file to crash software, modify memory and possibly perform remote execution when opened in vim...

Net-SNMP 代码问题漏洞

Net-SNMP is an open source Simple Network Management Protocol SNMP software. The software is used to monitor network devices, computer devices, UPS devices, and more. A code issue vulnerability exists in Net-SNMP that stems from a misformatted OID in GET-NEXT of nsVacmAccessTable that could resul...

PT-2022-7449 · Net Snmp +8 · Net-Snmp +8

Name of the Vulnerable Software and Affected Versions: net-snmp versions prior to 5.9.2 Description: The issue is related to a NULL pointer dereference in the nsVacmAccessTable function. A user with read-only credentials can exploit this by using a malformed OID in a GET-NEXT request to cause the...

vim: buffer over-read in function find_next_quote

A flaw was found in vim, where it is vulnerable to a buffer over-read in the findnextquote function. This flaw allows a specially crafted file to crash software, modify memory and possibly perform remote execution when opened in vim...

ZEIT Next.js 代码问题漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. NextAuth.js is the authentication for Next.js. A code issue vulnerability exists in Next.js NextAuth.js versions prior to 3.29.5 and prior to 4.5.0 that stems from a lack of validati...

Malicious Package

Overview next-plugin-normal is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...