Malicious code in assistants-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49dcd943b6b43273aa613aed19e623aa2ae67153ce323248811b64b441f38364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wix-smarts-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84e76a9b6116099c21d8ddfc842416facd8c4f184bcc94730e519e32c6f9c34e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7856 Malicious code in wix-smarts-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84e76a9b6116099c21d8ddfc842416facd8c4f184bcc94730e519e32c6f9c34e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-39693 Next.js Denial of Service (DoS) condition

Next.js is a React framework. A Denial of Service DoS condition was identified in Next.js. Exploitation of the bug can trigger a crash, affecting the availability of the server. his vulnerability was resolved in Next.js 13.5 and later...

ZEIT Next.js代码问题漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. A code issue vulnerability exists in ZEIT Next.js versions 13.4 through prior to 14.1.1 that stems from the presence of a server-side request forgery SSRF vulnerability...

GHSA-FR5H-RQP8-MJ6G Next.js Server-Side Request Forgery in Server Actions

Impact A Server-Side Request Forgery SSRF vulnerability was identified in Next.js Server Actions by security researchers at Assetnote. If the Host header is modified, and the below conditions are also met, an attacker may be able to make requests that appear to be originating from the Next.js...

XSS Marks the Spot: Digging Up Vulnerabilities in ChatGPT

With its widespread use among businesses and individual users, ChatGPT is a prime target for attackers looking to access sensitive information. In this blog post, Ill walk you through my discovery of two cross-site scripting XSS vulnerabilities in ChatGPT and a few other vulnerabilities. When...

GHSA-RV8P-RR2H-FGPG @apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability

Impact The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages. To fix this...

@apollo/experimental-nextjs-app-support Cross-site Scripting vulnerability

Impact The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This vulnerability arises from improper handling of untrusted input when @apollo/experimental-apollo-client-nextjs performs server-side rendering of HTML pages. To fix this...

CVE-2024-23841

CVE-2024-23841 affects the Next.js Apollo client integration, specifically the package @apollo/experimental-apollo-client-nextjs. The vulnerability is a cross-site scripting issue arising from improper handling of untrusted input during server-side rendering of HTML pages. Exploitation would requ...

PT-2024-20116 · Unknown · Apollo-Client-Nextjs +1

Name of the Vulnerable Software and Affected Versions: apollo-client-nextjs versions prior to 0.7.0 Description: The @apollo/experimental-apollo-client-nextjs NPM package is vulnerable to a cross-site scripting vulnerability. This issue arises from improper handling of untrusted input when the...

Apollo Cross-Site Scripting Vulnerability

Apollo is a set of PHP scripts by Alex Breen, an individual developer. It is intended to provide a web-based interface for students to upload coursework. A cross-site scripting vulnerability exists in Apollo apollo-client-nextjs versions prior to 0.7.0, which stems from mishandling of untrusted...

Insecure Direct Object Reference

nextjs is vulnerable to Insecure Direct Object Reference Vulnerability. The vulnerability is due to a logical flaw within the auth function in the App Router, and getAuth within the Pages Router. This issue can be exploited by an attacker to gain unauthorized access or conduct privilege escalatio...

GHSA-Q6W5-JG5Q-47VG @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Impact Unauthorized access or privilege escalation due to a logic flaw in auth in the App Router or getAuth in the Pages Router. Affected Versions All applications that that use @clerk/nextjs versions in the range of = 4.7.0, 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or...

@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)

Impact Unauthorized access or privilege escalation due to a logic flaw in auth in the App Router or getAuth in the Pages Router. Affected Versions All applications that that use @clerk/nextjs versions in the range of = 4.7.0, 4.29.3 in a Next.js backend to authenticate API Routes, App Router, or...

Malicious code in kratos-nextjs-react-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 002a702a76a5afe71ba598cb987b7d8cb8624bd74161c63a0e642fb288083bb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8553 Malicious code in kratos-nextjs-react-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 002a702a76a5afe71ba598cb987b7d8cb8624bd74161c63a0e642fb288083bb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@gem-sdk/pages (>=1.9.33, <=1.33.4) potentially affected by CVE-2023-46729 via @sentry/nextjs (>=7.46.0, <=7.57.0)

@sentry/nextjs NPM version =7.46.0, =1.9.33, =1.33.4 Source cves: CVE-2023-46729 Source advisory: OSV:GHSA-2RMR-XW8M-22Q9...

PT-2023-7670 · Unknown · Sentry-Javascript

Name of the Vulnerable Software and Affected Versions: sentry-javascript versions prior to 7.77.0 Description: The issue is related to insufficient input validation in the sentry-javascript SDK, specifically affecting the Next.js SDK tunnel endpoint. This allows an attacker to send HTTP requests ...

Malicious code in mux-meet-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a7f1d733a701939944e87966e022ec92915cd460d6293ee215e0e838ce752e77 The OpenSSF Package Analysis project identified 'mux-meet-nextjs' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...