22 matches found
CVE-2026-107369 Improper Validation of Post-Login Redirect URL in nextjs-auth0
The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or scheme-relative...
CVE-2026-107369
The auth0/nextjs-auth0 SDK contains an open redirect vulnerability due to improper validation of the returnTo parameter. While the SDK initially validates that the parameter is a same-origin URL, the subsequent reconstruction logic can produce a URL that browsers interpret as an absolute or schem...
PT-2026-113365
🚨 CVE-2026-107369 The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL. The SDK then stores this value and, in a later step, reconstructs it for the post-authentication redirect. The reconstruction logic can produce a URL that browsers interpret as an absolute or...
DRUPAL-CONTRIB-2026-035
The GTranslate module provides a language switcher widget for Drupal sites. The module’s widget JavaScript did not sufficiently validate that document.currentScript referred to the executing script element. A user who can add HTML to a page could cause the generated language-switcher links to poi...
GHSA-MM7P-FCC7-PG87 Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target. Payload: "[email protected] x"@internal.domain Using the following code to...
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
The email parsing library incorrectly handles quoted local-parts containing @. This leads to misrouting of email recipients, where the parser extracts and routes to an unintended domain instead of the RFC-compliant target. Payload: "[email protected] x"@internal.domain Using the following code to...
EUVD-2025-32876
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict...
CVE-2022-30258
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and...
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 : MaraDNS vulnerabilities (USN-6271-1)
The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6271-1 advisory. Xiang Li discovered that MaraDNS incorrectly handled certain inputs. If a user or an automated system were...
Debian dla-3457 : duende - security update
The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3457 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3457-1 [email protected]...
Design/Logic Flaw
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and...
CVE-2022-30258
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and...
CVE-2022-30257: Use of Incorrectly-Resolved Name or Reference
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and...
CVE-2022-30258: Use of Incorrectly-Resolved Name or Reference
An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and...
CVE-2022-30257
The CVE-2022-30257 entry affects Technitium DNS Server (versions through 8.0.2). Concrete details from connected sources show a flaw where variant V1 allows unintended domain name resolution: a revoked domain name can remain resolvable for an extended period, including expired or taken-down domai...
Design/Logic Flaw
An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and...
CVE-2022-30256
An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and...
CVE-2022-30256: Operation on a Resource after Expiration or Release
An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be resolvable for a long time, including expired domains and taken-down malicious domains. The effects of an exploit would be widespread and...
CVE-2022-30256
CVE-2022-30256 affects MaraDNS Deadwood up to version 3.5.0021, enabling variant V1 of unintended domain name resolution where a revoked domain can remain resolvable for long periods, including expired or taken-down domains. Impact is described as widespread and highly impactful and aligns with d...
