vim: buffer over-read in function find_next_quote

A flaw was found in vim, where it is vulnerable to a buffer over-read in the findnextquote function. This flaw allows a specially crafted file to crash software, modify memory and possibly perform remote execution when opened in vim...

ZEIT Next.js 代码问题漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. NextAuth.js is the authentication for Next.js. A code issue vulnerability exists in Next.js NextAuth.js versions prior to 3.29.5 and prior to 4.5.0 that stems from a lack of validati...

Malicious Package

Overview next-plugin-normal is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Command Injection

next-auth is vulnerable to command injection. The vulnerability exists in the assertConfig in assert.ts due to improper handling of user input which allows malicious attacker to inject and execute arbitrary commands...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-31093 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-31093 Source advisory: OSV:GHSA-G5FM-JP9V-2432...

GHSA-G5FM-JP9V-2432 Improper Handling of `callbackUrl` parameter in next-auth

Impact An attacker can send a request to an app using NextAuth.js with an invalid callbackUrl query parameter, which internally we convert to a URL object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led t...

Malicious code in react-table-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbb484eba3e35f4106a614061cf32e2e8022ed6d9b47266a02a4b2d921b6817f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5677 Malicious code in react-table-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbb484eba3e35f4106a614061cf32e2e8022ed6d9b47266a02a4b2d921b6817f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ng-focus-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 619332f760bccc1c45e41a4fa2a462947232534acc6bdb2790a338451c6fd2ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4844 Malicious code in ng-focus-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 619332f760bccc1c45e41a4fa2a462947232534acc6bdb2790a338451c6fd2ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in next-10-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b5c534bdaa68bbb90d47676a643fb06ac1c2281313fcbc5339d560275ece0c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4824 Malicious code in next-10-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b5c534bdaa68bbb90d47676a643fb06ac1c2281313fcbc5339d560275ece0c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-redux-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c925fbb7f1f8ff0a18bffa326943d62e0558498dfa914b896e91387fa6534fa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5671 Malicious code in react-redux-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c925fbb7f1f8ff0a18bffa326943d62e0558498dfa914b896e91387fa6534fa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-intl-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1232c7e53c78dc2566d0d6cfcc12422d7d7debe38b729c855588cca5796d0e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@atlaskit/editor-plugin-media-editing (>=0.1.0, <=1.2.1) potentially affected by unknown CVE via react-intl-next (0.0.1-security)

react-intl-next NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on react-intl-next and may be impacted: - @atlaskit/editor-plugin-media-editing =0.1.0, =1.2.1 Source cves: unknown CVE Source advisory: OSV:MAL-2022-5650...

MAL-2022-5650 Malicious code in react-intl-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1232c7e53c78dc2566d0d6cfcc12422d7d7debe38b729c855588cca5796d0e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-monorail-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f0a9004be0e59dea57780bc6d6ecf6d8d2cced159161b7b13030c87592bfb0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5654 Malicious code in react-monorail-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f0a9004be0e59dea57780bc6d6ecf6d8d2cced159161b7b13030c87592bfb0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polaris-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb96b8a0229b6d2dac86029266a0106019f5ee4ffbe68e10a5a88a39865d60f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...