7544 matches found
CVE-2022-39263 NextAuth.js Upstash Adapter missing token verification
@next-auth/upstash-redis-adapter is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use next-auth Email Provider and @next-auth/upstash-redis-adapter before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation...
CVE-2022-39263 NextAuth.js Upstash Adapter missing token verification
@next-auth/upstash-redis-adapter is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use next-auth Email Provider and @next-auth/upstash-redis-adapter before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation...
CVE-2022-39263
CVE-2022-39263 affects the Upstash Redis adapter for NextAuth.js when used with the Email Provider prior to v3.0.2. The adapter verifified only the identifier (email) and not the combined identifier + token in the email callback flow, enabling an attacker who knows the victim’s email (and token ex...
CVE-2022-39263 NextAuth.js Upstash Adapter missing token verification
@next-auth/upstash-redis-adapter is the Upstash Redis adapter for NextAuth.js, which provides authentication for Next.js. Applications that use next-auth Email Provider and @next-auth/upstash-redis-adapter before v3.0.2 are affected by this vulnerability. The Upstash Redis adapter implementation...
Hacker Behind Optus Breach Releases 10,200 Customer Records in Extortion Scheme
The Australian Federal Police AFP on Monday disclosed it's working to gather "crucial evidence" and that it's collaborating with overseas law enforcement authorities following the hack of telecom provider Optus. "Operation Hurricane has been launched to identify the criminals behind the alleged...
L2 network security controls can be bypassed using VLAN 0 stacking and/or 802.3 headers
Overview Layer-2 L2 network security controls provided by various devices, such as switches, routers, and operating systems, can be bypassed by stacking Ethernet protocol headers. An attacker can send crafted packets through vulnerable devices to cause Denial-of-service DoS or to perform a...
CVE-2022-39238 Improper Authentication in Arvados when using PAM as identity provider
Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules PAM for user authentication, if a user presented valid credentials but the account is disabled or otherwise not allowed to access the host such...
Ubuntu 22.04 LTS : OAuthLib vulnerability (USN-5632-1)
The remote Ubuntu 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5632-1 advisory. Sebastian Chnelik discovered that OAuthLib incorrectly handled certain redirect uris. A remote attacker could possibly use this issue to cause OAuthLib to crash,...
Shenzhen Lanning Software Co., Ltd. has SQL injection vulnerability in Lanning Intelligent Collaboration Platform
Shenzhen Lailing Software Co., Ltd. is a well-known large platform OA service provider and a leading knowledge management solution provider in China. It is a national high-tech enterprise specializing in knowledge-based consulting, software development, implementation and technical services for...
Webworm Hackers Using Modified RATs in Latest Cyber Espionage Attacks
A threat actor tracked under the moniker Webworm is taking advantage of bespoke variants of already existing Windows-based remote access trojans to fly under the radar, some of which are said to be in pre-deployment or testing phases. "The group has developed customized versions of three older...
RHEL 7 / 8 : OpenShift Container Platform 4.7.13 (RHSA-2021:2122)
The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2122 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...
Siemens Mendix SAML Module Authentication Bypass Vulnerability
Siemens Mendix SAML Module is an application module from Siemens, Germany. It is used to grant access to Mendix applications based on the end-user's identity in your identity provider. An authentication bypass vulnerability exists in Siemens Mendix SAML Module, which could be exploited by an...
CVE-2022-20395
In checkAccess of MediaProvider.java, there is a possible file deletion due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12...
Patch Tuesday - September 2022
This month’s Patch Tuesday is on the lighter side, with 79 CVEs being fixed by Microsoft including 16 CVEs affecting Chromium, used by their Edge browser, that were already available. One zero-day was announced: CVE-2022-37969 is an elevation of privilege vulnerability affecting the Log File Syst...
CVE-2022-35840
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...
CVE-2022-35836
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...
CVE-2022-35834
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...
CVE-2022-35835
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability...